http://www.eicar.com.)
This test file has been provided to EICAR for distribution as
the "EICAR Standard Anti-Virus Test File", and it satisifies all the
criteria listed above. It is safe to pass around, because it is not a
virus, and does not include any fragments of viral code. Most products
react to it as if it were a virus (though they typically report it with
an obvious name, such as "EICAR-AV-Test").
The file is a legitimate DOS
program, and produces sensible results when run ( it prints the message
"EICAR-STANDARD-ANTIVIRUS-TEST-FILE").
It is also short and simple --
in fact, it consists entirely of printable ASCII characters, so that it
can easily be created with a regular text editor. Any anti-virus product
which supports the EICAR test file should "detect" it in any file which
starts with the following 68 characters:
To keep things simple, the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The only thing to watch out for when typing in the test file is that the third character is the capital letter "O", not the digit zero. You are encouraged to make use of the EICAR test file. If you are aware of people who are looking for real viruses "for test purposes", bring the test file to their attention.
Click here if you wish to see a detailed analysis of the program's code: All the Details of EICAR.COM using DEBUG.
Back to the Starman's VIRUS page.