SEARCH

How-To Geek

Stupid Geek Tricks: Make Your Own Fake Virus with Notepad

image

Every geek wants to pretend that they are a dangerous hacker with the ability to take down any PC, and after you read this article, you can do show off your skills with nothing more than Notepad.

Of course, we’re not making an actual virus—it’s a fake virus. In fact, it’s a test virus. But it’s still fun, and today’s article is sponsored by reader Erik, who wrote in and told us about it.

Create a Fake Virus with Notepad

What we’re actually doing is re-creating the same technique talked about on eicar.org’s test virus page, except we’ve got better screenshots.

Open up a Notepad window, paste in the following text, and then save it.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

It should look exactly like this once you’ve pasted it…

image

And then you’ll almost instantly see a big fat warning that you’ve created a virus—as long as you’ve got anti-virus installed and working, of course. If you don’t see any warning, you should probably make sure your virus scanning software is properly enabled.

image

Your geek points will be wired to your WoW account, you dangerous hacker, you.

Lowell Heddings, better known online as the How-To Geek, spends all his free time bringing you fresh geekery on a daily basis. You can follow him on if you'd like.

  • Published 11/8/10

Comments (129)

  1. Louis

    More than the incoherent (bug) jargon, I enjoyed the last line of this post. And I have been laughing my head off ever since! Good one :)

  2. mickeyblue

    HMMMMM, interesting, our network uses Trend Netsuite and it didnt pick it up immediately, i had to manual scan the document. what a crock anti-virus.
    thanks, this helps my cause in changing our network anti-virus from trend.

  3. TEA

    Nod32 won´t let me even save such text file !

  4. rino

    @mickeyblue, we have av suite from trendmicro also and it just sits there doing nothing for zero day attacks.

    i’m showing it the door as next fiscal year, we’re either getting forefront or symantec’s.

  5. rino

    btw, microsoft security essentials immediately flagged it as virus.

  6. Susrich

    Thanks for this hint. My Free Avira Antivir Guard seems to sleep – nothing happens.

  7. GogoSymantec

    My symantec is running and nothing’s happening! Too lazy to do a full scan. Will let it sit on my desktop and see what happens.

  8. GogoSymantec

    Oh wait. In notepad, it saves. But it doesn’t appear on my desktop or anywhere else I try to save at. I guess it magically disappears! My symantec works!

  9. Abolfazl

    very very old tricks!

  10. Seasider

    Microsoft Security Essentials popped up straight away and the text file will not reopen. Cannot recreate even. Well done MSE.

  11. mono_lisa

    Hmm, AVG only detects something when I scan the file directly, but not when I tell it to scan the folder it was saved in. Bad AVG. Or bad me? Wrong settings?

    UPDATE: of course it’s me! I have the scan settings to infectable files only, which excludes .txt files.

  12. keith

    avast detects it onl in manual scan, while malwarebytes didnt detect anything, even with manual scan!

  13. Susrich

    @ mono_lisa: Stupid me, too!! Thanks for your comment. Now I know more (I was about to kick off avira).

  14. Daryl

    AVG default appears to be to only scan files with certain extensions, which doesn’t include TXT files.

    Anyone wishing to check/change the setting? Open AVG > Tools menu > Advanced Settings.. > Click the + next to Resident Shield > Click Advanced Settings. If you need more explanation beyond that point then you probably shouldn’t be fiddling around in Advanced Settings :)

  15. Hatryst

    Can you please explain how this works?

  16. Raju

    Technical Information (Analysis)Virus:DOS/EICAR_Test_File is not malicious and is a utility file created specifically to test that an antivirus application is functioning.

    Virus:DOS/EICAR_Test_File is also known as the ‘EICAR Standard Antivirus Test File’ or simply ‘EICAR’ (pronounced “i-kar”). This short file consists of the following 68 characters:
    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

    from http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Virus%3aDOS%2fEICAR_Test_File&threatid=2147519003

  17. Abhishek K. Pandey

    Is it just coincidence ?? I just read the same thing, with a different or may be a different virus script as well. That was also doing the same thing and that was used to verify is your av working or not. But that script was different.
    @ Hartyst: (1) Open a notepad.
    (2) Paste “X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*” (without “).
    (3) Save it with anyname.
    (4) If your av is working, it will detect it as a virus.

  18. Hatryst

    I mean, i want to know the stuff going on when this text file is created. What makes your AV think that this is a virus?

  19. rudy924

    This is a very foolishly conceived article. Real viruses cause enough headaches to users. WHY in the world would you want to encourage this activity?

  20. sid78669

    @rudy924: you have completely missed the whole point of this exercise! firstly it IS a fun thing to do without messing up you system. secondly from all the comments it should be crystal clear that people were able to test if their av worked or not!

  21. Pixel

    NOD32 dumped it to quarantine without saving….one of the best
    security suites.

  22. geetha

    Read the mail………….yet to test…..
    Plz send by g mail “HOW TO MOVE THE STRUCK OFF WINDOW SCREEN(XP)by mouse pointer, using your simple tricks.? Plz send message in my g mail by three or four lines to enable me to test the result &inform soon. thanks member gcn 8-11-10 806PM(IST)

  23. Yugi

    @ rudy924 : are you fool ?? Or already fool,eh ?

    EICAR IS A WORLD CLASS STANDART FOR GOOD ANTIVIRUS.

    Think first before speak,idiot.

  24. TheOatmeal

    haha, shut ur pie hole

  25. Ron

    ZoneAlarm worked like a champ!

  26. Paul

    “Well this file had absolutely no effect on my Linux machine” (says in a sarcastic voice). :)

  27. Mohamad

    Awesome Post!!!
    My Panda Cloud Pro didn’t detect it automatically, I had to scan it manually to get it neutralized!!
    Thanks dude!

  28. Abdunnoor

    Just to mention it…. the original eicar standards require that the file be saved with .com extension and NOT .txt. This pretty much sums up why some good Antiviruses dont pick it up.

  29. Shawn Clarady

    rudy924
    If you read the post you would see that is is not a real virus but only a test script. Did your AV pick it up quickly? Microsoft Security Essentials found it within 2 seconds WOW that is fast. I let it set their for a while and none of my other software found it. This is a good test.

  30. John Blanker

    “…This is a very foolishly conceived article. Real viruses cause enough headaches to users. WHY in the world would you want to encourage this activity?…”

    I TOTALLY Agree! After an hour of trying to get rid of a virus recently, what a headache! Why on earth would you want to publicize this?!? To test your antivirus program? Give me a break! It is fun to “Show off your hacker skills” to test your computer? You know what people are going to do with this.

    Viruses, fake or not, are not a joke. You know this will get into the wrong hands. This is not funny. Or would not be “fun” if you were on the receiving end.

    Keep up these kind of articles and I will be unsubscribing.

  31. Bob

    McAfee jumped right on it. Would not save.

  32. Mike

    Calm down JB. This is an EICAR test file and is used specifically for testing your AV product to make sure it works the way you want (example: that it gets stripped out of e-mail attachments properly). In no way is this malicious or teaches anyone anything about creating viruses.

    http://www.eicar.org/anti_virus_test_file.htm

  33. VoiceOfWisdom

    @John Blanker
    You sir are a fucktard.

  34. frank

    my norton internet security2011 picked it up as soon as i tried to save it with com or txt extension

  35. JimW

    Interesting exercise. However, if the purpose actually was to help us test our anti-virus, a more lengthy explanation should have been included. Indicating, as some have pointed out, that most anti-virus programs don’t scan text files by default. If you wanted to test your anti-virus, you should name it something ending in “.exe” or “.dll”…

    BTW, Malwarebytes is NOT an anti-virus. It’s anti-spyware.

  36. jaime d

    I can’t believe there are that many idiots here, didn’t anyone read that it was for fun, and if anyone finds it to be otherwise then GET A FRIGGIN’ LIFE!! As for getting into the wrong hands?????? are you stupid???? Never mind I can hear the duhs from here.

  37. frank

    f-secure let me save it but removed it after about 5 secs. not too happy with it.same if i rename it exe or bat. far too slow

  38. Hawk

    Avira Free detect file imediate.

  39. frank

    maybe mr. Geek could be so kind as to explain the purpose of the article then. i understood that the ages old string was just for playing but i ended up testing my av after seeing other people’s comments

  40. Paul

    This should make it clear:

    http://en.wikipedia.org/wiki/EICAR_test_file

    also a similar test for antispam:

    http://en.wikipedia.org/wiki/GTUBE

  41. McSquid

    cant wait to add this string to my brothers homework files.

  42. Kevalin

    @voiceofwisdom: while I agree that John Blanker could use a bit of a humor transplant (and yet, I also understand his frustration with seeing this article after dealing with a computer virus–those things can make God want to cuss), your seriously juvenile response kind of puts the lie to your user name, don’t you think?

    Nothing wrong with pretending to be grown up (and smart) enough to answer people you disagree with in a more or less civilized manner. Unless, of course, you ARE juvenile and/or stupid.

    Would that be the case?

  43. Anthony Cedrick Allen

    I was using Panda Cloud antivirus. It did not detect it even after I clicked it and manually scanned it. I replaced it with my favorite, Microsoft Security Essential, and it immediately deleted the file without even asking for my approval. Way to go Microsoft!

  44. Jeroen

    AVG did not complain when I saved the file as txt, then renamed it to .bat, but complained immediately when I changed the extension to .exe, which seems perfectly OK to me. It even provides an explanation about this being the mock virus test file.

  45. Sepehr

    My Norton says that EICAR test string was blocked.
    Test string?!
    Type of infection: virus, infects the other programs by adding it to their files!
    (something like that, translated from German)

  46. Alex

    I initially wondered why Avast wasn’t picking up on it when I first saved it, then I checked what the file was encoded with. Apparently Avast doesn’t detect it with UTF-8 encoding, only ANSI.

  47. vgamesx1

    WOW, MSE is amazing, soon as I saved the .txt it poped up saying I have a virus (the test).
    I love you.. MSE.

  48. Altyer

    Kaspersky don’t detect it even in manual scan!!!
    If I try any opereation like right-click or delete the file, my explorer crashes and My KIS 2011 keep sleeping…
    And if I try a manual scan in the parent folder, the AV just stops on some file, in a endless scan…

    May be KIS don’t worry about a old trick, but as you can see, it seems no so inoffensive…

  49. Altyer

    And I had to use the commmand line to delete it what was a delayed proccess, what can indicate that if I was waited some more time I could delete it in explorer or AV…
    Let me try again..

  50. Gordon

    LOL. Kaspersky Pure immediately delete the file right after I save it!

  51. `gene

    @McSquid It only sets of the Virus scanner when it is by itself.

    Also slow reactions aren’t all that bad, The scanner would (should?) jump in straight away only if the Virus is doing something. Or it would pick it up with normal scanning but constant immediate scanning of files just slows you down.

    Ran my own test Avast let me save it as a .txt no problem Just a text file serves no danger. Trying to save as an executable was stopped and popped up a virus warning

  52. calebstein

    Just as I test, I tried to see if BitDefender for Linux would catch it, and it did.

  53. memBrain

    It worked after I saved it. McAfee quarantined it a few seconds later. (an eternity in computer terms)

  54. Mr. X

    nice post, it work, i like it.

  55. Firebabe

    My MSE detected it approx 1 minute after i saved it :)

  56. Wingnut

    Well crap, I first saved it to my desktop as a .txt, & there it sits. Then I saved it to the same place as an .exe file, & there it sits. I have Trend Micro Pro, couch surfing in my windows7 Unlimited . I must need to do something with my settings.

  57. Mohit

    I never ever imagined MSE would detect it, but it did…just about a second after saving it

    i always thought free AVs didn’t do well…MSE seems to be an exception…

  58. yamar

    Using iAntiVirus on my mac with “protect my mac” enabled, found and quarantined the file less than a second after I saved it as a .txt.

    Good test file.

  59. cha

    I would like to know what this is telling the computer and what it all meens.. like brake it down.. if anyone could please..thanks…

  60. Alex

    @ John Blanker

    Please, by all means, please unsubscribe, we don`t need you here!

  61. Chronno S. Trigger

    @cha
    It doesn’t actually say or do anything, it’s just a standardized virus test file. Despite what some here may say, it is always good to test your security software from time to time. Test your backups, firewalls, and virus scanners. If your virus scanner cannot see this file with a .com extension, you need to get a new anti-virus.

  62. Trevor

    Norton detected it right off and cleaned it off my system. cool…

  63. The Unspoken

    Wow this string got long LOL!

    I read this when it came out and tested it and it worked. I also did some research to find out what it was. After reading that it was a TEST Virus; it was a cool feeling to have a new useful piece of info.

    I actually put this link into a steps for users who install our free Symantec Endpoint Protection on their home computers. You don’t need to be a geek to do this, if it works then AWESOME for the user.

    The Unspoken

  64. JPHN Milloshni

    Trend Micro will automatically delete the file as soon as you try and save it. If you save it while Trend is off Trend will automatically delete the file as soon as it loads, even though it leaves the icon the internal file is gone.

  65. Saurabh Goyal

    Good One..

    After saving the file it disappeared immediately by symantec

  66. cha

    Thank you, Chronno S. Trigger for your reply.It is people like you make sites intresting for people that wish to learn.
    AS for Alex my Apologies for your ignorance. Some people in life like to acquire knowledge and understanding, maybe you should except we are not all as inelegant as you would like to think you are. It is by asking questions that we all learn, even people like you. Thank you.

  67. jon

    KIS 2010 not even let me save it. But after I disable protection and then I can save the script to notepad. After that I run scan KIS detected that eicar test and delete it

  68. David

    Nice. I’m going to send it to my wifes computer :). My antivirus picked it up but I had to save it as an HTML file first (I’ve never done this before and made the mistake of saving it as a text file. Thanks.

  69. Vanessa

    Wow! Eset NOD32 put it on quarantine in an instant.

  70. Gouthaman Karunakaran

    Amazing trick. Panda Cloud Antivirus caught it as soon as I got the file.

  71. tracy

    My 1st attempt with antivirus off allowed me to save the file. The 2nd attempt (antivirus on) would not even let me save the file!! Pretty funny :-P

  72. tracy

    Kis 2010 btw

  73. Tylor Lavoie

    Yeah go MS Security Essentials!

  74. jonh connor

    something funny happens when i paste the code into a wordpad, if I paste it without any space between the first X, my antivirus detects the thread,
    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

    but if i put a space, o press enter, before the first X, the antivirus doesn’t work.
    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

    Any idea?

  75. Miichael

    It really works. Warning popped up and disappeared. I could not find the file where I saved. What happened to it? Will it affect my pc?

  76. Jack

    Kasperskie found it and deleted it.

    cute little trick :-)

  77. Matthew

    Norton blocked it immediately.

  78. Zebo

    Eset picked it instantly and quarantined it great stuff!

  79. Dark0Lord7

    Saved as TXT, and had to scan for Avira to detect. Saved as COM and it was detected in 1 second.

  80. Hackerpunk1

    Eset Nod32 Smart Security is the best antivirus. Light, Highly Secured, Smart Scan and Many More…..

  81. Mohammed

    Cool, Kaspersky Internet Security 2011 had crashed my notepad, when I tried to open the file.

  82. ilikefree

    Sounds like the “Shields Up” program for testing your firewall, which Windows always fails as it only works one way by default. But in this case it still tells you about your incomming firewall.

    I didn’t test this as others have already given their results for the anti-virus I use, E-Set Nod32

    JIMW I always thought MalwareBytes was to detect Malicious Software not spyware.

    Good article with a bit of passion in the middle of the comments.

  83. Josiah

    Avast ruins the prank, it actually tells you “no virus” virus when it pops up the notification. It allowed a txt version, blocked notepad from saving the exe version, and killed the scr version the moment it appeared.

  84. Marc

    Vipre didn’t do anything to it as a txt file, but when I saved it as a .exe, it smacked it right upside the head.

  85. STEREOTYPE

    I’m running AVAST! free alongside AVG Free, [Cheap, and redundant, I know]

    Neither program detected the file when saved as a .txt in ansi coding or otherwise, but as soon as I changed the extension to .bat, AVAST! noticed it,recognized it as a test file, and moved it to the “chest” immediately.

    @Cha
    No one here is going to explain to you the basics of hacking, you – alongside half of the others who have left comments on this website’s entry for this topic have COMPLETELY missed the point of the article, any viable purpose for you you even reading it has been pissed away with your silly approach, and undeniable hunger to waste your own time…

    If you think you’re a hacker, go join an IRC channel. If you’re any good at self-teaching, and you want to hone your skills, you must first impress a master. If you dont know any masters, then do what sucessful people have done- it seems to have worked for them.

  86. Symon

    avast only picks it up when you save it with .bat at the end

  87. Robin Mathew Rajan

    for all those computer noobs who had reported that their antivirus sat at a corner killing mosquitoes… u have to update your antivirus definition file frequently. Then only it has power to do anything…

  88. Scott

    Webroot picked it up instantly :D good way to test your antivirus. Webroot has never failed me.

  89. Kin

    Not working at my AVG at all… I saved it and scanned it manually, still nothing happened!

  90. joe

    i saved it as a .exe and avast detected it as a virus

  91. Mr.LOLZ

    lolz. this is just a test virus. nothing to worry about

  92. Eric

    Uh-oh. Saved it to My Documents and nothing came up. Scanned My Documents with my avast! and it found an infected file. Fight for your Right by the Beastie Boys…

  93. Scaffdog845

    As Abdunnoor mentioned the directions originally posted at http://www.eicar.org/anti_virus_test_file.htm state to save the file with “.com” as the extention. Mcafee did not pick it up as a threat through multiple open and close activities as a text file. Immediately after saving it as a “.com” file it was detected.

  94. blob

    avast did nothing until manually scanned. i’m very disappointed in avast and think i’ll switch

  95. Ronin Vladiamhe

    Nice ‘Stupid Geek Trick’ and makes for a good basic ‘tool’ to test antivirus programs and their settings. Has anyone taken a look at the antispam test file that Paul (Nov 8, 2010) mentioned. Are there any antispyware test files out there as well?

  96. Ken

    BT Netprotect (McAfee) found it immediately. Good test idea.

  97. Joel

    Well I just did this at work and let me tell you we are paying many thousands of dollars for this AV software we are running here and it didnt pick it up til I did a manual scan…. Great idea for testing purposes, very disappointed at our AV software.

  98. Simon

    Shit,
    After I saved the file my hard drive got deleted, There should be a warning before you, start telling people to do these things!!!!!!!!!!!

  99. sharan

    i renamed it as a png,and now its got stuck some how.cannt right click it,cant delete it…explorer becomes unresponsive,cant even delete it with safe mode :(
    any ideas on how to tackle this problem???

  100. Jayant Saxena

    @Simon

    Get a life dude , we know ure trolling

  101. Aaron

    I have BitDefender AV and not only did it pick it up as soon as I saved it , but it also came up saying it was a test virus and not a real one.

  102. mr bean

    it wont let me delete it!!!
    im running windows 7 home premium

  103. James

    Wow ass soon as I saved it AVG and Norton Poped up telling me OMG dude! Wait ? … Thats the thing called Mallishos Code? Man Is thats A Virus I dont know what is because That is just wierd! It Doesnt Make Sence… So what does it Do to cause it To be A threat Because That aint In any English Dictonary.

  104. kenny

    dang this thing works…my mcafee found it immedietly and now its gone!! i cant even do it again

  105. Dan

    Great… kaspersky cant get it and i need to know htf to delete it!!

  106. Dan

    Edit: Ok not that kaspersky cant delete it, it doesnt detect it. Now if i want to delete it from the explorer, it just spins and spins and spins with no end. and i cant click and drag either. (Win 7 home premium, and i saved it as .txt. is that bad?)

  107. bobbeh

    i have panda and the instant i opened it up, it sayed it neutralized it and cut out bits of the code for mah

  108. DSiDewd

    Kapersky caught it within 5 seconds.

  109. Doug

    it only seems to work using ANSI but not using UTF-8, and avast scanning both

  110. Karl thomas

    Save the name as (virus .bat) and select ( all files) under the save name

  111. sandeep tony

    AVG INTERNAT SECURITY 2011

    Removed And healed it.

    detected it as [virus identified EICAR_test]

  112. Zaugol

    norton360 just blocked and suspended that in like a heartbeat.

  113. john

    try right clicking on desktop, go to new, and shortcut. type in shutdown -s -t 30-c ” your words”

  114. niroj

    detected by norton in 3 seconds

  115. kees

    wat is de beste virus scaner
    die july denken]

  116. Andrew Tane

    man , it’s awesome it’s simple to do and it’s fun i will freak out my bro as soon as he comes!!!!!!!!!!!!!!!!

  117. Andrew Tane

    my bit deffender caught it when i saved it if i won’t save it so no response!why is it so???????

  118. App

    Wow, I tried this a long time ago and it didn’t work!
    But now, I updated my anti virus thing and it worked!!!
    Thanks!

  119. benny

    what extension do you add at the end?
    like:
    virus.txt
    virus.php
    virus.html
    virus.exe
    virus.

  120. Donavan

    Avast only detects it if you save it with .com at the end. Didnt detect it as a .txt so at first i was worried. Thanks, this is exactly what i was looking for.

  121. numan

    i saved the notepad as ‘a’ and saved in the desktop it automaticlly disappeared.what does this mean ???

  122. Justin

    It means that your virus program automatically deleted it. That’s what McAfee did for me.

  123. Mofasa

    darn,my avast can’t detect it…^_^

  124. KDS

    Never thought I would find so many idiots within a single thread, that don’t know the difference between malware, and Virus APPS / Scanners, or why their particular “Anti” did not pick up the eicar test file.

  125. Name (required)

    Kaspersky detects it after a second sais it has a virus, then gives the all clear as it deleates the file puts a copy in quaranteen and asks if you whant it permantly deleated… Thats some hard core ant-virus **** rightthere XD

  126. Name (required)

    @benny just make a new one on the desktop, copy/pate then click the SAVE not save-as then wait

  127. Rob

    I need help I it automatically put extension “.txt” and I saved it on desktop and now even when I try to delete it my computer doesn’t respond. PLEASE HELP

  128. rob

    Ok nevermind kapersky was slow but did sucessfully delete it

  129. god

    my schools system just deletes it straight away

Get Free Articles in Your Inbox!

Join 134,000 newsletter readers

Email:

Go check your email!