Anti Malware Testfile

Intended use

Boosted notes:

  1. This file used to be named ducklin.htm or ducklin-html.htm or similar based on its original author Paul Ducklin and was fabricated in cooperation with CARO.
  2. The definition of the file has been refined 1 May 2003 by Eddy Willems in cooperation with all vendors.
  3. The content of this documentation (title-merely) was adapted 1 September 2006 to add verification of the activity of anti-malware or anti-spyware products. It was decided non to change the file itself for astern-compatibility reasons.

Who needs the Anti-Malware Testfile

(read the complete text, it contains important information)
Version of seven September 2006

If yous are active in the anti-virus enquiry field, then you will regularly receive requests for virus samples. Some requests are easy to deal with: they come from fellow-researchers whom you lot know well, and whom you trust. Using stiff encryption, you tin can send them what they have asked for by almost whatever medium (including beyond the Internet) without whatever real take a chance.

Other requests come from people you have never heard from earlier. There are relatively few laws (though some countries do have them) preventing the secure exchange of viruses betwixt consenting individuals, though information technology is clearly irresponsible for yous simply to make viruses available to anyone who asks. Your best response to a request from an unknown person is simply to decline politely.

A third set of requests come from exactly the people y'all might recall would be least likely to want viruses „users of anti-virus software". They want some way of checking that they have deployed their software correctly, or of deliberately generating a „virus incident in order to test their corporate procedures, or of showing others in the organisation what they would run into if they were striking by a virus".

Reasons for testing anti-virus software

Obviously, there is considerable intellectual justification for testing anti-virus software confronting real viruses. If you lot are an anti-virus vendor, and then you exercise this (or should practise information technology!) earlier every release of your product, in lodge to ensure that it actually works. Nonetheless, you do non (or should not!) perform your tests in a „real" environs. You utilize (or should utilise!) a secure, controlled and independent laboratory environment inside which your virus collection is maintained.

Using real viruses for testing in the real world is rather similar setting fire to the dustbin in your office to see whether the fume detector is working. Such a test volition give meaningful results, but with unappealing, unacceptable risks.

Since information technology is unacceptable for you to ship out real viruses for examination or demonstration purposes, you need a file that can safely be passed around and which is obviously not-viral, but which your anti-virus software will react to as if it were a virus.

If your test file is a program, so it should also produce sensible results if it is executed. Also, because you probably want to avert aircraft a pseudo-viral file along with your anti-virus production, your test file should exist brusque and simple, so that your customers can easily create copies of it for themselves.

The good news is that such a test file already exists. A number of anti-virus researchers have already worked together to produce a file that their (and many other) products „find" as if it were a virus.

Agreeing on 1 file for such purposes simplifies matters for users: in the past, most vendors had their own pseudo-viral test files which their product would react to, only which other products would ignore.

The Anti-Malware Testfile

This test file has been provided to EICAR for distribution as the „EICAR Standard Anti-Virus Examination File", and it satisfies all the criteria listed to a higher place. Information technology is safe to pass effectually, because it is not a virus, and does not include whatever fragments of viral lawmaking. Most products react to it as if information technology were a virus (though they typically report it with an obvious name, such as „EICAR-AV-Exam").

The file is a legitimate DOS program, and produces sensible results when run (it prints the message „EICAR-STANDARD-ANTIVIRUS-TEST-FILE!").

It is as well short and simple – in fact, information technology consists entirely of printable ASCII characters, and then that it tin can hands be created with a regular text editor. Any anti-virus product that supports the EICAR exam file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long:

X5O!P%@AP[iv\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-Examination-FILE!$H+H*

The outset 68 characters is the known string. It may be optionally appended by whatever combination of whitespace characters with the total file length not exceeding 128 characters. The only whitespace characters immune are the space grapheme, tab, LF, CR, CTRL-Z. To keep things simple the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The only thing to watch out for when typing in the examination file is that the tertiary graphic symbol is the upper-case letter „O", non the digit zero.

You lot are encouraged to make apply of the EICAR test file. If you lot are aware of people who are looking for real viruses „for test purposes", bring the test file to their attention. If you are aware of people who are discussing the possibility of an manufacture-standard test file, tell them about world wide web.eicar.org, and point them at this article.

Download Anti Malware Testfile

In order to facilitate various scenarios, we provide iv files for download. The outset, eicar.com, contains the ASCII cord as described to a higher place. The second file, eicar.com.txt, is a copy of this file with a unlike filename. Some readers reported problems when downloading the get-go file, which tin be circumvented when using the second version. But download and rename the file to „eicar.com". That volition practice the trick. The tertiary version contains the test file inside a null archive. A proficient anti-virus scanner will spot a ‚virus' within an archive. The concluding version is a aught archive containing the third file. This file tin can be used to see whether the virus scanner checks archives more than than only one level deep.

In one case downloaded run your AV scanner. It should discover at least the file „eicar.com". Good scanners volition detect the ‚virus' in the unmarried zip annal and may be even in the double zippo archive. Once detected the scanner might non permit yous any access to the file(s) anymore. You might not fifty-fifty be allowed by the scanner to delete these files. This is caused past the scanner which puts the file into quarantaine. The test file will be treated only like any other existent virus infected file. Read the user's transmission of your AV scanner what to do or contact the vendor/manufacturer of your AV scanner.

Important NOTE
EICAR cannot exist held responsible when these files or your AV scanner in combination with these files cause whatsoever impairment to your computer.Yous DOWNLOAD THESE FILES AT YOUR OWN RISK. Download these files only if you are sufficiently secure in the usage of your AV scanner. EICAR cannot and will non provide whatever help to remove these files from your calculator. Please contact the manufacturer/vendor of your AV scanner to seek such assist.

Download area using the standard protocol HTTP
– Distressing, HTTP downoad ist temporarily not provided. –
Download area using the secure, SSL enabled protocol HTTPS
eicar.com
68 Bytes		 eicar.com.txt
68 Bytes		 eicar_com.zilch
184 Bytes		 eicarcom2.zip
308 Bytes

How to delete the test file from your PC

Nosotros understand (from the many emails we receive) that it might be difficult for you to delete the test file from your PC. After all, your scanner believes it is a virus infected file and does not allow you to access it anymore. At this point we must refer to our standard answer concerning support for the test file. We are sorry to tell you lot that EICAR cannot and will not provide AV scanner specific support. The best source to become such data from is the vendor of the tool which you purchased.

Please contact the back up people of your vendor. They have the required expertise to help you in the usage of the tool. Needless to say that you should have read the user'south manual first before contacting them.