Virus Profile: EICAR test file

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home N/A | Corporate N/A
Date Discovered: 10/15/1996
Date Added: 5/3/2000
Origin: AV Industry
Length: N/A
Type: Virus
Subtype: Tool
DAT Required: 4001
Removal Instructions
   
 
 
   

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

This is not a virus, but a tool designed to determine if an antivirus product is installed properly. This is a small .COM file used to test the effectiveness and operability of on-access and/or on-demand scanning of an antivirus product.

Methods of Infection

This is not a virus.

Aliases

EICAR Test String.68, EICAR-AV-Test, EICAR-Test-File
   

Virus Characteristics

This is not a virus, but a tool designed to determine if an antivirus product is installed properly. This is a small .COM file used to test the effectiveness and operability of on-access and/or on-demand scanning of an antivirus product.

This tool is an industry recognized testing file. The name is derived from an organization named EICAR, or European Institute for Computer Anti-Virus Research. The file, and its use, is also described at this website.

The file is comprised of a test string, and is a DOS executable. Running the file should not do anything more than display a message on your screen:

EICAR-STANDARD-ANTIVIRUS-TEST-FILE

The EICAR.COM test file can be obtained from either EICAR or by copying the text below into NOTEPAD and saving the file as EICAR.COM:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The file should be 68 or 70 bytes in length and is an executable on Intel platforms. If on-access scanning is enabled, the file will be detected during the save process in NOTEPAD.

There is one known attack on the concept of the EICAR test file; please read the description of Bat/Bwg.a@MM for details.

PC Infected? Get Expert Help

McAfee
Virus Removal Service

Connect to one of our Security Experts by phone. Have your PC fixed remotely - while you watch!

$89.95