Free tool
Is your antivirus switched on? Find out safely.
The EICAR test file is a harmless piece of text that every antivirus product is built to recognise as a test. Download it, and your protection should stop it. If nothing happens, you have learned something important for free.
How to run it
Four steps, about two minutes
- Check you are allowed to. On a work device, tell whoever looks after your IT first. If we look after your security, our monitoring will probably raise an alert, so give us a ring before you start or expect a call from us.
- Open EICAR’s download page using the button below. It opens their site, which is where the files live.
- Download
eicar.com.txtfirst, and watch what happens. - Then try
eicar_com.zip, the same file inside a zip, to see whether your protection looks inside archives.
This takes you to eicar.org, the European Institute for Computer Antivirus Research. We do not host the file here, and the FAQ below explains why.
What it means
Read the result
What happens when you download it tells you which layer of protection is working.
-
Good The download is blocked before it finishes
Your web filter is inspecting downloads and stopped it before it reached the device. That is the best result, because the file never arrived.
-
Good It downloads, then disappears or is quarantined
Your antivirus is scanning in real time and caught it on arrival. The filter did not, which is usually because it cannot see inside HTTPS downloads (see below).
-
Worth a look The plain file is caught, but the zip is not
Your protection is switched on but is not looking inside archives, which is a common way real malware is delivered by email and download.
-
Act on this Nothing happens at all
The file downloaded and nothing stopped it. Either the antivirus is switched off, has been disabled, or is not scanning files as they arrive. Delete the file and talk to us or whoever looks after your IT.
What it cannot tell you
A pass proves it is on, not that it is good
Practically every security product on the market catches EICAR, so a pass tells you the protection is switched on and scanning. It says nothing about how well it would do against real malware, which changes daily and is written to avoid detection. That is where monitoring by people, rather than software on its own, earns its keep.
And EICAR serves its files over HTTPS, which is encrypted. A web filter can only look inside an encrypted download if it has been set up to inspect encrypted traffic. Many are not, which is why the antivirus on the device so often ends up catching it instead. If you want to know which is true of your setup, this is the kind of thing we look at.
Questions
The things people ask first
Is the EICAR test file safe?
Yes. It is 68 characters of plain text that does nothing harmful. Run on an old DOS computer, all it does is print a line of text. Antivirus products recognise it only because they are deliberately built to, so people can test them without handling real malware. Once your antivirus has caught it, it may not let you open or delete the file yourself, and that is fine to leave.
Will it set off alarms at work?
It may. A managed security service is meant to notice a detection and look into it, so on a work device, tell your IT team or provider before you test. If we look after your security, ring us first.
Why don’t you host the file yourselves?
Because every security product detects it, including the services that rate websites as safe or unsafe. A site that serves the file can end up marked as a source of malware, and then the web filters protecting our own clients might start blocking us. EICAR hosts the official files, so we send you to them.
Should I test my phone as well?
It is worth knowing the answer, but phones handle downloads differently and many have no antivirus scanning files at all, so a phone that lets it through is common. What protects a work phone is usually how it is managed, which apps can be installed and whether it is kept up to date.
Next step
Did nothing happen?
Tell us what you tested on and what you saw. We will tell you what is switched off and what it takes to fix it.