Anti Malware Testfile

Intended employ

Additional notes:

  1. This file used to be named ducklin.htm or ducklin-html.htm or similar based on its original author Paul Ducklin and was made in cooperation with CARO.
  2. The definition of the file has been refined one May 2003 past Eddy Willems in cooperation with all vendors.
  3. The content of this documentation (title-only) was adapted 1 September 2006 to add verification of the action of anti-malware or anti-spyware products. Information technology was decided not to change the file itself for backward-compatibility reasons.

Who needs the Anti-Malware Testfile

(read the complete text, it contains important data)
Version of vii September 2006

If you are active in the anti-virus inquiry field, and then you will regularly receive requests for virus samples. Some requests are easy to deal with: they come from boyfriend-researchers whom you lot know well, and whom you trust. Using strong encryption, you can transport them what they have asked for by almost any medium (including across the Internet) without whatsoever real risk.

Other requests come from people you have never heard from before. At that place are relatively few laws (though some countries do take them) preventing the secure exchange of viruses betwixt consenting individuals, though it is clearly irresponsible for you simply to make viruses available to anyone who asks. Your best response to a request from an unknown person is simply to refuse politely.

A third set of requests come from exactly the people you might retrieve would be to the lowest degree likely to desire viruses „users of anti-virus software". They want some way of checking that they have deployed their software correctly, or of deliberately generating a „virus incident in order to examination their corporate procedures, or of showing others in the organisation what they would see if they were hit by a virus".

Reasons for testing anti-virus software

Obviously, there is considerable intellectual justification for testing anti-virus software confronting real viruses. If you are an anti-virus vendor, then you practice this (or should do it!) before every release of your product, in society to ensure that it really works. However, y'all practise non (or should not!) perform your tests in a „existent" environment. You employ (or should apply!) a secure, controlled and independent laboratory surround inside which your virus drove is maintained.

Using existent viruses for testing in the real world is rather like setting fire to the dustbin in your office to see whether the smoke detector is working. Such a test volition requite meaningful results, just with unappealing, unacceptable risks.

Since it is unacceptable for you to ship out real viruses for test or sit-in purposes, you need a file that can safely exist passed around and which is plain not-viral, but which your anti-virus software will react to as if it were a virus.

If your test file is a program, then it should also produce sensible results if information technology is executed. Also, because you probably desire to avoid shipping a pseudo-viral file along with your anti-virus product, your test file should be short and simple, then that your customers can hands create copies of information technology for themselves.

The good news is that such a test file already exists. A number of anti-virus researchers accept already worked together to produce a file that their (and many other) products „notice" as if it were a virus.

Agreeing on one file for such purposes simplifies matters for users: in the past, most vendors had their own pseudo-viral exam files which their product would react to, but which other products would ignore.

The Anti-Malware Testfile

This test file has been provided to EICAR for distribution as the „EICAR Standard Anti-Virus Examination File", and information technology satisfies all the criteria listed above. It is condom to pass effectually, because it is not a virus, and does not include any fragments of viral code. Nearly products react to it every bit if it were a virus (though they typically study it with an obvious proper name, such as „EICAR-AV-Exam").

The file is a legitimate DOS program, and produces sensible results when run (information technology prints the bulletin „EICAR-STANDARD-ANTIVIRUS-TEST-FILE!").

It is also short and simple – in fact, information technology consists entirely of printable ASCII characters, so that information technology can easily exist created with a regular text editor. Any anti-virus production that supports the EICAR exam file should detect it in whatever file providing that the file starts with the following 68 characters, and is exactly 68 bytes long:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-Examination-FILE!$H+H*

The first 68 characters is the known string. Information technology may be optionally appended by whatsoever combination of whitespace characters with the full file length non exceeding 128 characters. The simply whitespace characters immune are the space character, tab, LF, CR, CTRL-Z. To go on things simple the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The merely thing to watch out for when typing in the test file is that the third character is the capital „O", not the digit zero.

Yous are encouraged to make apply of the EICAR examination file. If you are aware of people who are looking for existent viruses „for test purposes", bring the test file to their attending. If you lot are aware of people who are discussing the possibility of an industry-standard exam file, tell them about world wide web.eicar.org, and point them at this article.

Download Anti Malware Testfile

In order to facilitate diverse scenarios, we provide 4 files for download. The commencement, eicar.com, contains the ASCII string as described above. The 2d file, eicar.com.txt, is a copy of this file with a different filename. Some readers reported problems when downloading the first file, which tin exist circumvented when using the second version. Just download and rename the file to „eicar.com". That will practice the trick. The tertiary version contains the test file inside a cipher archive. A skilful anti-virus scanner will spot a ‚virus' inside an archive. The final version is a cipher archive containing the third file. This file can be used to run into whether the virus scanner checks athenaeum more than than only i level deep.

Once downloaded run your AV scanner. It should discover at least the file „eicar.com". Good scanners will detect the ‚virus' in the unmarried zero annal and may exist even in the double zip archive. In one case detected the scanner might not allow yous any access to the file(due south) anymore. You might non fifty-fifty be allowed by the scanner to delete these files. This is caused by the scanner which puts the file into quarantaine. The examination file will be treated merely like any other existent virus infected file. Read the user'southward manual of your AV scanner what to practise or contact the vendor/manufacturer of your AV scanner.

Important Annotation
EICAR cannot be held responsible when these files or your AV scanner in combination with these files cause any damage to your computer.Yous DOWNLOAD THESE FILES AT YOUR Ain RISK. Download these files only if you are sufficiently secure in the usage of your AV scanner. EICAR cannot and will non provide whatsoever help to remove these files from your computer. Please contact the manufacturer/vendor of your AV scanner to seek such help.

Download area using the standard protocol HTTP
– Sorry, HTTP downoad ist temporarily not provided. –
Download expanse using the secure, SSL enabled protocol HTTPS
eicar.com
68 Bytes		 eicar.com.txt
68 Bytes		 eicar_com.zip
184 Bytes		 eicarcom2.zippo
308 Bytes

How to delete the examination file from your PC

Nosotros understand (from the many emails nosotros receive) that information technology might exist difficult for you to delete the examination file from your PC. After all, your scanner believes it is a virus infected file and does not allow yous to access it anymore. At this point we must refer to our standard answer concerning support for the test file. We are sorry to tell you that EICAR cannot and will not provide AV scanner specific support. The all-time source to become such information from is the vendor of the tool which you purchased.

Please contact the support people of your vendor. They have the required expertise to aid you lot in the usage of the tool. Needless to say that you should have read the user'south manual first before contacting them.