The “EICAR Standard Anti-Virus Test File”, is not a virus, and does not include any fragments of viral code. It produces sensible results when run (it prints the message “EICAR-STANDARD-ANTIVIRUS-TEST-FILE!”). It is also short and simple – in fact, it consists entirely of printable ASCII characters, so that it can easily be created with a regular text editor. Any anti-virus product that supports the EICAR test file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long:
How to make it
1. Open your notepad
2. Copy the following code and past it in notepad
3. Save the file with “.com” extension.
Then your anti virus will recognize it ASAP.
The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. The only whitespace characters allowed are the space character, tab, LF, CR, CTRL-Z. To keep things simple the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The only thing to watch out for when typing in the test file is that the third character is the capital letter “O”, not the digit zero. You are encouraged to make use of the EICAR test file. If you are aware of people who are looking for real viruses “for test purposes”, bring the test file to their attention.