Threat Description



Category: Clean - Not Malware
Type: Other
Platform: W32
Aliases: EICAR, Eicar-test-file, Eicar_test_file


The EICAR Standard Anti-Virus Test file is a special 'dummy' file used to check and confirm the correct operation of security products.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

EICAR is the European Institute of Computer Anti-virus Research (

The EICAR Standard Anti-Malware Test file is a special 'dummy' file which is used to test the correct operation of malware detection scanners. When an EICAR test file is downloaded or scanned, ideally the scanner will detect it exactly as if it were a malicious program.

The EICAR test file is normally used to:

  • Confirm the security application is installed and functioning correctly
  • Observe the product's actions when a malicious program is found
  • Check internal procedures and reactions when a malicious program is found
Downloading an EICAR file

Users who would like to check the correct operation of their F-Secure security products can download the EICAR test file from the EICAR organization's website at: EICAR: Anti-Malware Test File Download.

Creating and using an EICAR file

Alternatively, to create an EICAR test file, use any text editor to create a file with the following single line in it:


Save the file with any name using a COM extension; for example, EICAR.COM. Make sure you save the file in standard MS-DOS ASCII format. Now you can use this file to demonstrate what occurs when a virus is detected.

When executed, the EICAR test file will simply display the text "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!" and exit.


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More