An antivirus test should use a documented test file, not live malware. EICAR provides a harmless standardized file intended to trigger a compatible antivirus product's detection path.
Run a controlled check#
Read the instructions on the official EICAR test-file page before downloading anything. Use the download or test procedure your security product supports, and expect the browser or antivirus to block or quarantine the file.
Check the product's event history after the attempt. Record whether it blocked the transfer, quarantined a saved file, or reported a scan detection. Those are different points in the protection path.
What a successful detection does not prove#
Detecting EICAR does not measure protection against every threat, validate a firewall, or prove that an entire device is clean. It only checks the behavior exercised by that test. Do not disable protection to make the file download successfully, and do not send the test through someone else's systems without agreement.
The earlier article also mixed antivirus and spam testing. Apache SpamAssassin's GTUBE test concerns compatible spam filters; it is a separate test and does not imply that every antivirus product scans email for spam.
