Do not write or download real malware, even if you intend it to be harmless. For a safe detection test, use the EICAR Anti-Malware Test File: a deliberately inert 68-byte text artifact that many antivirus products recognize and quarantine. It contains no destructive payload, persistence, propagation, encryption, or system-changing routine.
What a “fake virus” really is
A real virus is malware that can replicate or perform unauthorized harmful actions. EICAR is not a virus; it is a standardized test file whose exact content is treated as a malware signature. Calling it an antivirus test file or malware-detection test artifact is more accurate.
As an Amazon Associate I earn from qualifying purchases.
Use EICAR instead of a homemade executable or script. Custom code can be misclassified, distributed accidentally, trigger incident-response workflows, or contain an unnoticed harmful operation. A prank window claiming that files were encrypted is also unsafe: people may mistake it for a real attack.
EICAR is intended to test a narrow detection and response path. It does not provide a complete antivirus or endpoint-security assessment.
#1 Best Overall
The EICAR test string
The standard file must contain these 68 ASCII characters exactly:
X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Do not add spaces, quotation marks, or a trailing newline. Extra bytes, a UTF-8 byte-order mark, or a copied character can change the result. The official specification is at eicar.org/download-anti-malware-testfile/.
Windows: create the file with PowerShell
This is the quickest offline method. Microsoft documents it for Defender validation.
- Confirm that your active antivirus is enabled; do not turn off real-time protection.
- Open PowerShell.
- Run:
[IO.File]::WriteAllText("$env:USERPROFILEDesktopeicar.com",'X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*',[Text.Encoding]::ASCII)
Defender or another product may block the write, remove the file, or quarantine it before it appears on the Desktop. That immediate interception is an expected successful detection.
Microsoft’s documented creation method and exclusion guidance are at Microsoft Learn.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Windows: create it with Notepad
- Open Notepad and paste the exact EICAR string.
- Select File → Save As.
- Set Save as type to All files.
- Name the file
eicar.comand choose an ASCII-compatible encoding if an encoding menu is shown. - Save it in a temporary test folder.
Antivirus software generally inspects content, not just the filename, so detection can occur before Notepad finishes saving. Do not bypass a block merely to make the file remain on disk.
Download the official test file
Use only EICAR’s official HTTPS page: https://www.eicar.org/download-anti-malware-testfile/. It provides eicar.com, eicar.com.txt, and ZIP variants for archive testing.
Microsoft’s documented PowerShell example is:
Invoke-WebRequest "https://secure.eicar.org/eicar.com.txt" -OutFile "$env:USERPROFILEDesktopeicar.com.txt"
A browser, mail gateway, cloud service, or endpoint product may block the download. That is normal; do not disable protection to force it through.
Check the result in Windows Security
- Open Windows Security.
- Choose Virus & threat protection → Protection history.
- Find the EICAR detection or quarantine event.
- Confirm that the item was blocked, removed, or quarantined.
Labels vary by Windows release, language, organizational policy, and the active antivirus provider. Supported Windows versions normally include Microsoft Defender Antivirus unless another antimalware product has taken over.
See Microsoft’s provider information at support.microsoft.com/en-US/windows-antivirus-software-providers.
Enterprise validation with Defender for Endpoint
For centralized alerting, the device must be onboarded to the relevant Defender service, real-time protection must be enabled, and reporting connectivity and policy must be working. Generate the EICAR event, check local protection history, then verify that the alert reaches the Defender portal. Reporting can be delayed, suppressed by policy, or absent if the device is not correctly onboarded.
Microsoft documents validation for Windows, Windows Server, Linux, and macOS at learn.microsoft.com/en-us/defender-endpoint/validate-antimalware. Built-in consumer Defender and the enterprise Defender for Endpoint service are different management experiences.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteLinux and macOS (Microsoft Defender for Endpoint only)
These commands are not universal antivirus commands. Use them only where the Microsoft Defender for Endpoint command-line tool is installed and configured.
Best Value
Check real-time protection
mdatp health --field real_time_protection_enabled
Proceed only when the result indicates that real-time protection is enabled.
Download on Linux
curl -o eicar.com.txt https://secure.eicar.org/eicar.com.txt
Download on macOS
curl -o ~/Downloads/eicar.com.txt https://secure.eicar.org/eicar.com.txt
Recommended Free Tools
List recorded threats
mdatp threat list
Archive, exclusion, and extension tests
| Goal | Method |
|---|---|
| Basic file detection | Create the standard EICAR text or .com file. |
| Archive scanning | Use the official eicar.com.zip or eicar.com-2.zip. |
| File or folder exclusion | Place EICAR at the exact excluded path, under an authorized test policy. |
| Extension exclusion | Use the target extension only where the product permits it. |
| Process exclusion | EICAR is not a process-exclusion test; use the vendor’s documented procedure. |
Never leave a permanent antivirus exclusion. Remove temporary exclusions immediately after testing. Microsoft distinguishes file, folder, and extension checks from process-exclusion validation at Microsoft Learn.
What EICAR proves—and what it cannot prove
It can verify
- That a known test signature is detected.
- That blocking or quarantine responds.
- That an endpoint can generate and report a basic alert.
- How configured file, folder, or extension exclusions behave.
It cannot verify
- Detection of novel malware or fileless attacks.
- Macro, exploit, credential-theft, persistence, or lateral-movement defenses.
- Ransomware-like file activity or command-and-control traffic.
- Process-based behavioral detections or a complete EDR/XDR workflow.
An EICAR event demonstrates one signature-and-response path, not overall product effectiveness. Different vendors, operating systems, file types, and policies may handle it differently.
Troubleshooting
| Symptom | Likely explanation and action |
|---|---|
| The file disappears | Real-time protection probably quarantined it immediately. Check protection history or the enterprise portal. |
| No detection appears | Check real-time protection, the active antivirus provider, exact string and encoding, monitored location, EICAR support, and enterprise onboarding. |
| The file is not 68 bytes | An editor added a newline, byte-order mark, spaces, quotes, or another character. Recreate it exactly with ASCII and no newline. |
| The browser blocks the download | That is expected. Use the official EICAR page or the documented local PowerShell method; do not disable protection. |
| Local alert but no portal event | Check onboarding, licensing, connectivity, reporting delay, and alert-suppression policy. |
| A third-party product does not react | EICAR support is widespread but not universal, and behavior is vendor- and policy-dependent. |
Cleanup
- Let the antivirus product quarantine or delete the artifact.
- Open its quarantine or protection-history screen and permanently remove the test item.
- Delete the temporary test folder and any duplicate downloads or ZIP files.
- Remove temporary exclusions created for the test.
- Do not restore the file unless a controlled procedure specifically requires it, and do not submit it to a public malware repository as real malware.
Safer alternatives for demonstrations and broader testing
- For a classroom or article image, use a clearly labeled static mockup marked “DEMO,” not a deceptive executable or fake system warning.
- For phishing, potentially unwanted application, cloud, or other antimalware features, use AMTSO security-feature checks or the vendor’s approved validation tools.
- For realistic attack behavior, use an authorized security-exercise platform and documented scope rather than homemade malware.
The Bottom Line
Use the official EICAR test file—not custom malware—to trigger a controlled antivirus event. It is free, easy to remove, and useful for validating basic detection, quarantine, and reporting, but it is not a full security test.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
