EICAR

Threat description

Details

Category: Clean - Not Malware
Type: Other
Platform: W32

Summary

The EICAR Standard Anti-Virus Test file is a special 'dummy' file used to check and confirm the correct operation of security products.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details

EICAR is the European Institute of Computer Anti-virus Research ( https://www.eicar.org).

The EICAR Standard Anti-Malware Test file is a special 'dummy' file which is used to test the correct operation of malware detection scanners. When an EICAR test file is downloaded or scanned, ideally the scanner will detect it exactly as if it were a malicious program.

The EICAR test file is normally used to:

  • Confirm the security application is installed and functioning correctly
  • Observe the product's actions when a malicious program is found
  • Check internal procedures and reactions when a malicious program is found
Downloading an EICAR file

Users who would like to check the correct operation of their F-Secure security products can download the EICAR test file from the EICAR organization's website at: EICAR: Anti-Malware Test File Download.

Creating and using an EICAR file

Alternatively, to create an EICAR test file, use any text editor to create a file with the following single line in it:

  • X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Save the file with any name using a COM extension; for example, EICAR.COM. Make sure you save the file in standard MS-DOS ASCII format. Now you can use this file to demonstrate what occurs when a virus is detected.

When executed, the EICAR test file will simply display the text "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!" and exit.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More