How to check if your antivirus is working [ Antivirus ]

Most of the time we just install the antivirus or the anti Malware programs and relax that they are working fine and one fine morning you see things not working and finally you realize that its your antivirus program which was not working at all. Here is a small test which you can do in case you are not sure if your antivirus program is working fine or not.

#1 Open Notepad and paste this string into it ( without double quotes )

“X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* ”

#2 Save it and as soon as you do your antivirus real time protection should be able to detect it. In case you have disabled the real time protection run a scan for this file.

This file actually is a dummy virus which simulates like a virus which is provided by EICAR for distribution as the “EICAR Standard Anti-Virus Test File”, The file is a legitimate DOS program, and produces sensible results when run (it prints the message “EICAR-STANDARD-ANTIVIRUS-TEST-FILE!”). You can read more on this at EICAR Antivirus Test File

string showing antvitus test file contents

For those of you who say your auto scan doesn’t detect it… I have tried on a few anti-virus… If your anti-virus doesn’t scan text files under real time then it will not detect it until you do a system scan.

To make it detect it real-time you need to tell your real-time scan to scan all files, not just “smart” file scan.

You can test it by saving as an exe or other format that is on the auto detect file list.

(+42 rating, 9 votes)

Loading ...

About The Author of this article:
Ashish is one of the co-author of this blog and writes on various interesting softwares, PC tips and more. You can read more of his articles here.

Enjoyed this article? Download our Toolbar ( for Free ) and read us more quickly or Free Subscribe to the Full RSS Feed or Get Post like this in your Inbox Click to get via Email ( You will have to confirm by checking you Inbox)

Tags: anti malware programs, anti virus, antivirus protection, antivirus_software, eicar, malware

92 Comments and Link-Backs to “How to check if your antivirus is working [ Antivirus ]”

Click Me and Jump to Add your Comment :)

86 Comments from Friends and Readers

Rakshit, February 23, 2008:

Ok, so I am going to test my antivirus with a dummy virus…….
hope it shows the positive results.
Madhur Kapoor, February 23, 2008:

Norton was successful in detecting it immediately . stumbled
Ashish Mohta, February 23, 2008:

Thanks Madhur for the udpate. one of our readers reported that AVG Failed.
Charlie, February 23, 2008:

Yes Ashish, AVG free edition failed to detect this “test virus”
jake, February 24, 2008:

Avast free didn’t detect it until i ran a scan.
Ashish Mohta, February 24, 2008:

@Jake: Thanks. Looks like both avg and avast failed here. Lets see if we get more feed back?
james, February 24, 2008:

ESET NOD32 picked it up right away. Thanks! Stumbled.
Ashish Mohta, February 24, 2008:

@James: Thanks a lot. So we have Norton and Nod32 are the only ones picking up. Some more feedback and we can hava na analysis
Snufkin, February 26, 2008:

Avira Antivir didn’t pick up on it until I scanned the file.
Charles, February 26, 2008:

Kaspersky found it the second I saved it.
Ashish Mohta, February 26, 2008:

Hi Snufkin,

Thanks for avira update. Was your real time protection on or you do it manually ?
Ashish Mohta, February 26, 2008:

Hi Charles,

Thanks cool looks like I never knew this anti virus. I will check it.
Justin, February 26, 2008:

no apple with norton 2008
Steev, February 26, 2008:

The only time I’ve ever used that is for testing newly installed mail servers & such. I don’t know if it’s really meant for Windows testing, & it’s not malicious, so it’s reasonable that some AV companies wouldn’t include it in their signatures, it’s not necessarily an indication of the effectiveness (or lack of) of your AV if it doesn’t pick up on it…

Stumbled nonetheless, I’ve always downloaded it before, never knew it was so short & you could just create it as a text file, handy.

So easily memorable too, just rolls of the tongue. All together now X5O!P%@AP[4\PZX5… er…
Snufkin, February 26, 2008:

I had the real-time protection on, though it wasn’t until I physically clicked on the file and told Antivir to scan the file that it picked it up. Also, this is the Free edition of Antivir.
James, February 26, 2008:

ESTD NOD32 picked it up straight away, didn’t give any alert though. I had to check the quarantine to find out where it had gone
Chris, February 27, 2008:

McAfee Enterprise 8 dected and deleted the second I saved
james, February 27, 2008:

@James
What version of NOD32 are you using? I’m using 3.0.621.0 and didn’t have such an issue. The second I clicked on it, the alert popped up for me.
Eric, February 27, 2008:

Try having the file extension end as .com, .exe, .vbs, etc. Many anti-virus programs look at a txt file and decide that they don’t care since its not executable code. This lowers the risk of false positives with an ever so slight decrease in security.

My copy of Avast didn’t care when it ended in .txt, but the second I renamed it to .com, it detected it. Naming it whatever.com.txt also does not cause the on-access scanner in Avast to freak out, but trying to download the eicar test file from the Eicar website as a text document does trigger Avast. Obviously Avast is programmed to be less trusting of stuff from the internet.
Ryan, February 27, 2008:

I just tested this out and it work instantly right away with Avast

I found that it only works right right away if you save it as anything except .txt

.mov, .mp3, .doc, .xxx, .txr, etc…anything but .txt
secuono, February 27, 2008:

avanquest system suite pro got it when i scanned it.
Ashfame, February 27, 2008:

NOD32 v3 also catches it. Stumbled!
Eric, February 27, 2008:

Perhaps Avast and other A/V programs are programmed to ignore the Eicar test file if it ends in TXT. Otherwise, how are you going to store the test file on your systems if your A/V software will not let you?
Ashish Mohta, February 27, 2008:

@Eric: Your are right. I would have thought about it before. A txt file is not treated by antivirus many a times. So possibly thats why some of the Anti virus are not able to detect it
Ashish Mohta, February 27, 2008:

@Ryan: Thanks for pointing out that. a txt file does have less chances of getting detected
Ashish Mohta, February 27, 2008:

@Eric: It gets stored momentarily but get caught and either deleted or quarnatied. Many AV have dropped this test possibly due to some reason.
Brian, February 28, 2008:

Interesting. I paid for AVG Anti-Malware and it didn’t detect it when I saved it as a text file, but if I save it as an .exe and then click on it, AVG identifies it as EICAR_Test and won’t let it continue.
spayced, February 28, 2008:

There is so much wrong with this. Listen up, idiots.

Don’t deliberately put a virus on your computer. That’s stupid.
How do you know it’s a test? If you don’t understand what ““X5O!P%@AP[4\PZX54(P^)7CC)7}” is then you don’t know. So don’t do it.

Anti-virus companies know about these tests, and in time they patch their program to pass the tests, rather than actually protecting the method or design the test uses. Meaning it may protect against test viruses and not real ones. You have no way of knowing, so the test is worthless.

It gets worse. With the laziest antivirus makers, they may present you the dialog window claiming that it stopped it, when in reality it did not stop it at all (windows oneCare does this all the time, the dirty liars).
Sebastian, February 29, 2008:

Actually, Avast! free edition does detect it the second i save it as a .exe. No need to click on it or anything. If i just leave it as a .txt, i’ll have to scan it manually to get avast to detect it.
Dante, February 29, 2008:

AVG picked it up for me
Thomas, February 29, 2008:

Command Antivirus from Authentium does not care when it is name .txt, but deletes it immediately when you rename to .com It will also detect it if you run a scan, even if it is .txt
Griffin, February 29, 2008:

Yay! PC-Cillin detected it when I ran a scan.
I still hate it though, before I got my Quad-Core it used 25% of the processor at all times (on an 2GHz single core AMD.)
Gonna install some other opensource/ freeware one after I reinstall Windows.
NoNoNoNo, February 29, 2008:

Avira detects it immediately, if you save it as *.bat or any executive file *.exe and so on.
Angiefaerie, February 29, 2008:

CA Antivirus (ca.com) picked it up right away
Chris Finlay, February 29, 2008:

Oddly, despite real-time protection being on, AVG didn’t pick this up until I told it to scan the file.
Sebastian, February 29, 2008:

All of the programs dont propably scan .txt-files in real-time protection, ’cause they cannot be executed like .exe or other executable files.
DrKnow, February 29, 2008:

My norton blocked it and didn’d save it but identified it ad EICAR test string. If they identified it as a test string why did they block it?
ugod, March 1, 2008:

Avira Antivir immediately reported a virus when i saved the file
Surferbob644, March 1, 2008:

Changing the file extension from .txt to .exe got my Avast! Free Addition to react immediately
Bill Vincent, March 1, 2008:

Confirmed, Avast ignores TXT files as far as real-time scanning. If you force a scan, it detects the string. If you change the extension to bin, or exe, or iso, or anything like that, Avast will respond instantly.

Checked this on 3 Windows machines.

Cool, I know now this has been around a while, but hadn’t seen before. Thanks!
Bill Vincent, March 1, 2008:

Dr. KNow: it didn’t really “identify” it, as far as I can tell, the av scanner gets the ‘identity’ of the ‘virus’ from the string itself. The scanner doesn’t know it’s just a test.
Ashish Mohta, March 1, 2008:

Thanks Bill. Cool you tested on 3. Probably we will come out with an analytics post on this.
Fili, March 3, 2008:

Windows LiveOne Care does not pick it up even with a full system scan.
Not surprising.
21stcenturyman, March 5, 2008:

If some AV failed to detect a test file, imagine new threats and vulnerabilities.
That’s why I do not trust antivirus programs as you can check on my blog.
AYEHAN, March 8, 2008:

Hi,

ESET NOD32 Smart Security v3.0.551.0 detected it the same second i save it as a “virus.txt” file

Detected “EICAR File Test”
Jasmine, March 11, 2008:

Thanks for sharing. Just now I know that antivirus might be not working though it looks find. I will check my antiviruses periodictly.
Andreas, March 12, 2008:

Avast’s On Demand Scanner dosen’t scan TXT files on acces per default.
U must remove them from the blacklist.
Also the pagefile and other file types are listed there.

When u save the TXT file and scan it via right mouse click avast will find it 100%
nathix, March 12, 2008:

AVG 7.5 with firewall successfully found and healed this file, but only once renamed as FILE.EXE and double clicked.
least it works, and its not hogging all my resources for stuff although i don’t download
AVG is amazing, purely because i works and it’snot in your face the whole time
Patti, March 12, 2008:

SystemSuite8 found it once I searched specifically on my desktop. Great tester.

Thumbs up.
Ashish Mohta, March 12, 2008:

looks like its time to make an analysis. Thanks for all the feedback
Sergio420, March 12, 2008:

AVG Professional 7.5 found it immediately. Thanks for the post and stumbled.
Nameless, March 12, 2008:

BitDefender 2008 Internet Security responded immediately, by putting it in quarintine
sane, March 13, 2008:

I tested this using Avast Home and found that it failed so I went thought the configuration and found that under the Standard Shield -> Customize… -> Advanced tab there is a rule that dose not scan *.txt files. If you remove that rule or you do a manual scan of the txt file it will catch the “Virus”.
mr toasty, March 13, 2008:

When saved as a .txt file Trend Micro 2008 needed a manual scan to detect it.

Caught and quarantined it the instant i saved it as an .exe though
Keith Johnson, March 13, 2008:

Awesome article, and great way to test using this little line of code. Many thanks for the suggestion and sharing this with the web-community. Regards, Keith Johnson, Author & Spiritual Blogger (www.ommeditation.info).
geo, March 13, 2008:

Kaspersky picked to up straight away
catey, March 14, 2008:

Windows Live One Care caught it immediately.
Flan, March 14, 2008:

Zone Alarm caught it and quarantined it in about half a second
Anna, March 14, 2008:

NOD32 picked it up when i saved
Chris, March 14, 2008:

Zone Alarm anti-virus picked it up.
Rohit Khurana, March 14, 2008:

Nice trick
TurboFool, March 15, 2008:

Sophos did not detect this one automatically or when scanned.
Stu, March 16, 2008:

I tried it with avast!, but it only recognised it as a potential threat when I performed a manual scan :/
mr yungles, March 17, 2008:

McAfee Security Center deleted it as soon as I saved it. It didn’t even notify me, it just disappeared from my desktop.
DeathWish808, March 17, 2008:

I use both AVG Anti-Spyware and AntiVirus Free and they both picked it up after the file was scanned. If you tried to run it it would pick it up automatically. If you use the paid versions then it picks it up automatically. I have paid version on one PC and free on the others.
acidicwolverine, March 18, 2008:

Windows Live OneCare detected it as soon as I saved. Gave option to clean which took about 30 seconds and file was gone.
$hadow, March 18, 2008:

NOD32 caught it right away!!!
coz NOD32 RULES!!!
sotec, March 18, 2008:

nice articel. i will try it
Ashish Mohta, March 18, 2008:

Cool Sotec, Do tell us what your antivirus said about it
Lewis Therin, March 20, 2008:

AVG Free Edition picked it up at once when I saved it as an EXE
Rob, March 21, 2008:

I use Mcafee, soon as I saved it, found it right away. I’ve had bad luck with Norton. There is more then one tiime I install a different virus scanner, and it finds trojans and stuff that norton did not find.

Using WinXP
Rick, March 23, 2008:

Well, this is cool.

Avast 4.7 home edition & AVG Free didn’t detect it until i scanned it.

But anyway i like this, Stumbled (Thumbs Up)
emma, March 23, 2008:

Using Norman Virus Control.. detected and removed it as soon as i saved it. Cool poat!
Johnny, March 23, 2008:

AVG free dosen’t pick this up at all
Justin, March 23, 2008:

For those of you who say your auto scan doesn’t detect it… I have tried on a few anti-virus… If your anti-virus doesn’t scan text files under real time then it will not detect it until you do a system scan.

To make it detect it real-time you need to tell your real-time scan to scan all files, not just “smart” file scan.

You can test it by saving as an exe or other format that is on the auto detect file list.

Pretty neat test, I would suggest you mention this on the website.

Some anti-virus scans don’t scan real time on all flies and a txt file is usually ignored until a full-system scan.
Ashish Mohta, March 23, 2008:

Hi Justin

Thanks for pointing out that. I have updated and hope you stumbled it too.

Ashish
John L, March 26, 2008:

AVG 7.5 Anti Malware recognised it correctly as an EICAR test file. It would appear that this is well known so is it possible that some Antivirus programs might well ignore it bearing in mind that they are updated at least once a day ?
Shakti, April 3, 2008:

HI

I use the ESET smart security, man its too good
Just after clicking it, i blasted that file off my computer..
Superb
Mr Avast, April 5, 2008:

I can confirm that, if saved as a .exe, Avast will immediately recognise it.
radz, April 29, 2008:

nod32 AV business edition detected it. but it didnt show up like a pop up.
baniladjam, May 8, 2008:

Tried the test on Avast!, it didn’t detect it until I run a scan. OneCare and Norton detected it.
stranger, June 12, 2008:

avast 4.8 only detected it after i run a manual scan but not in real time thats gay i believed avast was the best in the business. whats more disappointing its the pro version as well.
Joel Thomas, June 18, 2008:

I dont know how I missed this post earlier but found through stumbleupon. I tested with Avast Home edition and it detected when I saved it as exe file and not when as text file. Cool tip.
Now I know my antivirus is working!
vijayayadav, June 19, 2008:

amazing
i tried it and my mcafee immediately detected it and never allowed me to save the file
someone, July 15, 2008:

pc tools antivirus also found the virus, but only when you double click the exe file, or use a manual scan.
ed per, August 27, 2008:

Try it in Panda Internet Security 2008 and it was detected immediately … nice post .