The test virus is detectable by antivirus software dating from 1996 onwards. Many of the AMTSO Feature Settings Checks are based on the EICAR test string. The use of the EICAR test string can be more versatile than straightforward detection: a file containing the EICAR test string can be compressed or archived, and then the antivirus software can be run to see whether it can detect the test string in the compressed file. Neither the way in which the file is detected nor the wording with which it is flagged are standardized, and may differ from the way in which real malware is flagged, but should prevent it from executing as long as it meets the strict specification set by European Institute for Computer Antivirus Research. Not all virus scanners are compliant, and may not detect the file even when they are correctly configured. A compliant virus scanner, when detecting the file, will respond in more or less the same manner as if it found a harmful virus. Īnti-virus programmers set the EICAR string as a verified virus, similar to other identified signatures. Instead of using real malware, which could cause real damage, this test file allows people to test anti-virus software without having to use a real computer virus.

The EICAR Anti-Virus Test File or EICAR test file is a computer file that was developed by the European Institute for Computer Antivirus Research (EICAR) and Computer Antivirus Research Organization (CARO), to test the response of computer antivirus (AV) programs. Security information and event management (SIEM).Host-based intrusion detection system (HIDS).

Eicar test file