How-To Geek
Stupid Geek Tricks: Make Your Own Fake Virus with Notepad
Every geek wants to pretend that they are a dangerous hacker with the ability to take down any PC, and after you read this article, you can do show off your skills with nothing more than Notepad.
Of course, we’re not making an actual virus—it’s a fake virus. In fact, it’s a test virus. But it’s still fun, and today’s article is sponsored by reader Erik, who wrote in and told us about it.
Create a Fake Virus with Notepad
What we’re actually doing is re-creating the same technique talked about on eicar.org’s test virus page, except we’ve got better screenshots.
Open up a Notepad window, paste in the following text, and then save it.
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*It should look exactly like this once you’ve pasted it…
And then you’ll almost instantly see a big fat warning that you’ve created a virus—as long as you’ve got anti-virus installed and working, of course. If you don’t see any warning, you should probably make sure your virus scanning software is properly enabled.
Your geek points will be wired to your WoW account, you dangerous hacker, you.
Got Feedback? Join the discussion at discuss.howtogeek.com
Comments (129)
Programmer by day, geek by night, The Geek, also known as Lowell Heddings, spends all his free time bringing you fresh geekery on a daily basis. You can follow him on Google+ if you'd like.
- Published 11/8/10
More than the incoherent (bug) jargon, I enjoyed the last line of this post. And I have been laughing my head off ever since! Good one :)
HMMMMM, interesting, our network uses Trend Netsuite and it didnt pick it up immediately, i had to manual scan the document. what a crock anti-virus.
thanks, this helps my cause in changing our network anti-virus from trend.
Nod32 won´t let me even save such text file !
@mickeyblue, we have av suite from trendmicro also and it just sits there doing nothing for zero day attacks.
i’m showing it the door as next fiscal year, we’re either getting forefront or symantec’s.
btw, microsoft security essentials immediately flagged it as virus.
Thanks for this hint. My Free Avira Antivir Guard seems to sleep – nothing happens.
My symantec is running and nothing’s happening! Too lazy to do a full scan. Will let it sit on my desktop and see what happens.
Oh wait. In notepad, it saves. But it doesn’t appear on my desktop or anywhere else I try to save at. I guess it magically disappears! My symantec works!
very very old tricks!
Microsoft Security Essentials popped up straight away and the text file will not reopen. Cannot recreate even. Well done MSE.
Hmm, AVG only detects something when I scan the file directly, but not when I tell it to scan the folder it was saved in. Bad AVG. Or bad me? Wrong settings?
UPDATE: of course it’s me! I have the scan settings to infectable files only, which excludes .txt files.
avast detects it onl in manual scan, while malwarebytes didnt detect anything, even with manual scan!
@ mono_lisa: Stupid me, too!! Thanks for your comment. Now I know more (I was about to kick off avira).
AVG default appears to be to only scan files with certain extensions, which doesn’t include TXT files.
Anyone wishing to check/change the setting? Open AVG > Tools menu > Advanced Settings.. > Click the + next to Resident Shield > Click Advanced Settings. If you need more explanation beyond that point then you probably shouldn’t be fiddling around in Advanced Settings :)
Can you please explain how this works?
Technical Information (Analysis)Virus:DOS/EICAR_Test_File is not malicious and is a utility file created specifically to test that an antivirus application is functioning.
Virus:DOS/EICAR_Test_File is also known as the ‘EICAR Standard Antivirus Test File’ or simply ‘EICAR’ (pronounced “i-kar”). This short file consists of the following 68 characters:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
from http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Virus%3aDOS%2fEICAR_Test_File&threatid=2147519003
Is it just coincidence ?? I just read the same thing, with a different or may be a different virus script as well. That was also doing the same thing and that was used to verify is your av working or not. But that script was different.
@ Hartyst: (1) Open a notepad.
(2) Paste “X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*” (without “).
(3) Save it with anyname.
(4) If your av is working, it will detect it as a virus.
I mean, i want to know the stuff going on when this text file is created. What makes your AV think that this is a virus?
This is a very foolishly conceived article. Real viruses cause enough headaches to users. WHY in the world would you want to encourage this activity?
@rudy924: you have completely missed the whole point of this exercise! firstly it IS a fun thing to do without messing up you system. secondly from all the comments it should be crystal clear that people were able to test if their av worked or not!
NOD32 dumped it to quarantine without saving….one of the best
security suites.
Read the mail………….yet to test…..
Plz send by g mail “HOW TO MOVE THE STRUCK OFF WINDOW SCREEN(XP)by mouse pointer, using your simple tricks.? Plz send message in my g mail by three or four lines to enable me to test the result &inform soon. thanks member gcn 8-11-10 806PM(IST)
@ rudy924 : are you fool ?? Or already fool,eh ?
EICAR IS A WORLD CLASS STANDART FOR GOOD ANTIVIRUS.
Think first before speak,idiot.
haha, shut ur pie hole
ZoneAlarm worked like a champ!
“Well this file had absolutely no effect on my Linux machine” (says in a sarcastic voice). :)
Awesome Post!!!
My Panda Cloud Pro didn’t detect it automatically, I had to scan it manually to get it neutralized!!
Thanks dude!
Just to mention it…. the original eicar standards require that the file be saved with .com extension and NOT .txt. This pretty much sums up why some good Antiviruses dont pick it up.
rudy924
If you read the post you would see that is is not a real virus but only a test script. Did your AV pick it up quickly? Microsoft Security Essentials found it within 2 seconds WOW that is fast. I let it set their for a while and none of my other software found it. This is a good test.
“…This is a very foolishly conceived article. Real viruses cause enough headaches to users. WHY in the world would you want to encourage this activity?…”
I TOTALLY Agree! After an hour of trying to get rid of a virus recently, what a headache! Why on earth would you want to publicize this?!? To test your antivirus program? Give me a break! It is fun to “Show off your hacker skills” to test your computer? You know what people are going to do with this.
Viruses, fake or not, are not a joke. You know this will get into the wrong hands. This is not funny. Or would not be “fun” if you were on the receiving end.
Keep up these kind of articles and I will be unsubscribing.
McAfee jumped right on it. Would not save.
Calm down JB. This is an EICAR test file and is used specifically for testing your AV product to make sure it works the way you want (example: that it gets stripped out of e-mail attachments properly). In no way is this malicious or teaches anyone anything about creating viruses.
http://www.eicar.org/anti_virus_test_file.htm
@John Blanker
You sir are a fucktard.
my norton internet security2011 picked it up as soon as i tried to save it with com or txt extension
Interesting exercise. However, if the purpose actually was to help us test our anti-virus, a more lengthy explanation should have been included. Indicating, as some have pointed out, that most anti-virus programs don’t scan text files by default. If you wanted to test your anti-virus, you should name it something ending in “.exe” or “.dll”…
BTW, Malwarebytes is NOT an anti-virus. It’s anti-spyware.
I can’t believe there are that many idiots here, didn’t anyone read that it was for fun, and if anyone finds it to be otherwise then GET A FRIGGIN’ LIFE!! As for getting into the wrong hands?????? are you stupid???? Never mind I can hear the duhs from here.
f-secure let me save it but removed it after about 5 secs. not too happy with it.same if i rename it exe or bat. far too slow
Avira Free detect file imediate.
maybe mr. Geek could be so kind as to explain the purpose of the article then. i understood that the ages old string was just for playing but i ended up testing my av after seeing other people’s comments
This should make it clear:
http://en.wikipedia.org/wiki/EICAR_test_file
also a similar test for antispam:
http://en.wikipedia.org/wiki/GTUBE
cant wait to add this string to my brothers homework files.
@voiceofwisdom: while I agree that John Blanker could use a bit of a humor transplant (and yet, I also understand his frustration with seeing this article after dealing with a computer virus–those things can make God want to cuss), your seriously juvenile response kind of puts the lie to your user name, don’t you think?
Nothing wrong with pretending to be grown up (and smart) enough to answer people you disagree with in a more or less civilized manner. Unless, of course, you ARE juvenile and/or stupid.
Would that be the case?
I was using Panda Cloud antivirus. It did not detect it even after I clicked it and manually scanned it. I replaced it with my favorite, Microsoft Security Essential, and it immediately deleted the file without even asking for my approval. Way to go Microsoft!
AVG did not complain when I saved the file as txt, then renamed it to .bat, but complained immediately when I changed the extension to .exe, which seems perfectly OK to me. It even provides an explanation about this being the mock virus test file.
My Norton says that EICAR test string was blocked.
Test string?!
Type of infection: virus, infects the other programs by adding it to their files!
(something like that, translated from German)
I initially wondered why Avast wasn’t picking up on it when I first saved it, then I checked what the file was encoded with. Apparently Avast doesn’t detect it with UTF-8 encoding, only ANSI.
WOW, MSE is amazing, soon as I saved the .txt it poped up saying I have a virus (the test).
I love you.. MSE.
Kaspersky don’t detect it even in manual scan!!!
If I try any opereation like right-click or delete the file, my explorer crashes and My KIS 2011 keep sleeping…
And if I try a manual scan in the parent folder, the AV just stops on some file, in a endless scan…
May be KIS don’t worry about a old trick, but as you can see, it seems no so inoffensive…
And I had to use the commmand line to delete it what was a delayed proccess, what can indicate that if I was waited some more time I could delete it in explorer or AV…
Let me try again..
LOL. Kaspersky Pure immediately delete the file right after I save it!
@McSquid It only sets of the Virus scanner when it is by itself.
Also slow reactions aren’t all that bad, The scanner would (should?) jump in straight away only if the Virus is doing something. Or it would pick it up with normal scanning but constant immediate scanning of files just slows you down.
Ran my own test Avast let me save it as a .txt no problem Just a text file serves no danger. Trying to save as an executable was stopped and popped up a virus warning
Just as I test, I tried to see if BitDefender for Linux would catch it, and it did.
It worked after I saved it. McAfee quarantined it a few seconds later. (an eternity in computer terms)
nice post, it work, i like it.
My MSE detected it approx 1 minute after i saved it :)
Well crap, I first saved it to my desktop as a .txt, & there it sits. Then I saved it to the same place as an .exe file, & there it sits. I have Trend Micro Pro, couch surfing in my windows7 Unlimited . I must need to do something with my settings.
I never ever imagined MSE would detect it, but it did…just about a second after saving it
i always thought free AVs didn’t do well…MSE seems to be an exception…
Using iAntiVirus on my mac with “protect my mac” enabled, found and quarantined the file less than a second after I saved it as a .txt.
Good test file.
I would like to know what this is telling the computer and what it all meens.. like brake it down.. if anyone could please..thanks…
@ John Blanker
Please, by all means, please unsubscribe, we don`t need you here!
@cha
It doesn’t actually say or do anything, it’s just a standardized virus test file. Despite what some here may say, it is always good to test your security software from time to time. Test your backups, firewalls, and virus scanners. If your virus scanner cannot see this file with a .com extension, you need to get a new anti-virus.
Norton detected it right off and cleaned it off my system. cool…
Wow this string got long LOL!
I read this when it came out and tested it and it worked. I also did some research to find out what it was. After reading that it was a TEST Virus; it was a cool feeling to have a new useful piece of info.
I actually put this link into a steps for users who install our free Symantec Endpoint Protection on their home computers. You don’t need to be a geek to do this, if it works then AWESOME for the user.
The Unspoken
Trend Micro will automatically delete the file as soon as you try and save it. If you save it while Trend is off Trend will automatically delete the file as soon as it loads, even though it leaves the icon the internal file is gone.
Good One..
After saving the file it disappeared immediately by symantec
Thank you, Chronno S. Trigger for your reply.It is people like you make sites intresting for people that wish to learn.
AS for Alex my Apologies for your ignorance. Some people in life like to acquire knowledge and understanding, maybe you should except we are not all as inelegant as you would like to think you are. It is by asking questions that we all learn, even people like you. Thank you.
KIS 2010 not even let me save it. But after I disable protection and then I can save the script to notepad. After that I run scan KIS detected that eicar test and delete it
Nice. I’m going to send it to my wifes computer :). My antivirus picked it up but I had to save it as an HTML file first (I’ve never done this before and made the mistake of saving it as a text file. Thanks.
Wow! Eset NOD32 put it on quarantine in an instant.
Amazing trick. Panda Cloud Antivirus caught it as soon as I got the file.
My 1st attempt with antivirus off allowed me to save the file. The 2nd attempt (antivirus on) would not even let me save the file!! Pretty funny :-P
Kis 2010 btw
Yeah go MS Security Essentials!
something funny happens when i paste the code into a wordpad, if I paste it without any space between the first X, my antivirus detects the thread,
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
but if i put a space, o press enter, before the first X, the antivirus doesn’t work.
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Any idea?
It really works. Warning popped up and disappeared. I could not find the file where I saved. What happened to it? Will it affect my pc?
Kasperskie found it and deleted it.
cute little trick :-)
Norton blocked it immediately.
Eset picked it instantly and quarantined it great stuff!
Saved as TXT, and had to scan for Avira to detect. Saved as COM and it was detected in 1 second.
Eset Nod32 Smart Security is the best antivirus. Light, Highly Secured, Smart Scan and Many More…..
Cool, Kaspersky Internet Security 2011 had crashed my notepad, when I tried to open the file.
Sounds like the “Shields Up” program for testing your firewall, which Windows always fails as it only works one way by default. But in this case it still tells you about your incomming firewall.
I didn’t test this as others have already given their results for the anti-virus I use, E-Set Nod32
JIMW I always thought MalwareBytes was to detect Malicious Software not spyware.
Good article with a bit of passion in the middle of the comments.
Avast ruins the prank, it actually tells you “no virus” virus when it pops up the notification. It allowed a txt version, blocked notepad from saving the exe version, and killed the scr version the moment it appeared.
Vipre didn’t do anything to it as a txt file, but when I saved it as a .exe, it smacked it right upside the head.
I’m running AVAST! free alongside AVG Free, [Cheap, and redundant, I know]
Neither program detected the file when saved as a .txt in ansi coding or otherwise, but as soon as I changed the extension to .bat, AVAST! noticed it,recognized it as a test file, and moved it to the “chest” immediately.
@Cha
No one here is going to explain to you the basics of hacking, you – alongside half of the others who have left comments on this website’s entry for this topic have COMPLETELY missed the point of the article, any viable purpose for you you even reading it has been pissed away with your silly approach, and undeniable hunger to waste your own time…
If you think you’re a hacker, go join an IRC channel. If you’re any good at self-teaching, and you want to hone your skills, you must first impress a master. If you dont know any masters, then do what sucessful people have done- it seems to have worked for them.
avast only picks it up when you save it with .bat at the end
for all those computer noobs who had reported that their antivirus sat at a corner killing mosquitoes… u have to update your antivirus definition file frequently. Then only it has power to do anything…
Webroot picked it up instantly :D good way to test your antivirus. Webroot has never failed me.
Not working at my AVG at all… I saved it and scanned it manually, still nothing happened!
i saved it as a .exe and avast detected it as a virus
lolz. this is just a test virus. nothing to worry about
Uh-oh. Saved it to My Documents and nothing came up. Scanned My Documents with my avast! and it found an infected file. Fight for your Right by the Beastie Boys…
As Abdunnoor mentioned the directions originally posted at http://www.eicar.org/anti_virus_test_file.htm state to save the file with “.com” as the extention. Mcafee did not pick it up as a threat through multiple open and close activities as a text file. Immediately after saving it as a “.com” file it was detected.
avast did nothing until manually scanned. i’m very disappointed in avast and think i’ll switch
Nice ‘Stupid Geek Trick’ and makes for a good basic ‘tool’ to test antivirus programs and their settings. Has anyone taken a look at the antispam test file that Paul (Nov 8, 2010) mentioned. Are there any antispyware test files out there as well?
BT Netprotect (McAfee) found it immediately. Good test idea.
Well I just did this at work and let me tell you we are paying many thousands of dollars for this AV software we are running here and it didnt pick it up til I did a manual scan…. Great idea for testing purposes, very disappointed at our AV software.
Shit,
After I saved the file my hard drive got deleted, There should be a warning before you, start telling people to do these things!!!!!!!!!!!
i renamed it as a png,and now its got stuck some how.cannt right click it,cant delete it…explorer becomes unresponsive,cant even delete it with safe mode :(
any ideas on how to tackle this problem???
@Simon
Get a life dude , we know ure trolling
I have BitDefender AV and not only did it pick it up as soon as I saved it , but it also came up saying it was a test virus and not a real one.
it wont let me delete it!!!
im running windows 7 home premium
Wow ass soon as I saved it AVG and Norton Poped up telling me OMG dude! Wait ? … Thats the thing called Mallishos Code? Man Is thats A Virus I dont know what is because That is just wierd! It Doesnt Make Sence… So what does it Do to cause it To be A threat Because That aint In any English Dictonary.
dang this thing works…my mcafee found it immedietly and now its gone!! i cant even do it again
Great… kaspersky cant get it and i need to know htf to delete it!!
Edit: Ok not that kaspersky cant delete it, it doesnt detect it. Now if i want to delete it from the explorer, it just spins and spins and spins with no end. and i cant click and drag either. (Win 7 home premium, and i saved it as .txt. is that bad?)
i have panda and the instant i opened it up, it sayed it neutralized it and cut out bits of the code for mah
Kapersky caught it within 5 seconds.
it only seems to work using ANSI but not using UTF-8, and avast scanning both
Save the name as (virus .bat) and select ( all files) under the save name
AVG INTERNAT SECURITY 2011
Removed And healed it.
detected it as [virus identified EICAR_test]
norton360 just blocked and suspended that in like a heartbeat.
try right clicking on desktop, go to new, and shortcut. type in shutdown -s -t 30-c ” your words”
detected by norton in 3 seconds
wat is de beste virus scaner
die july denken]
man , it’s awesome it’s simple to do and it’s fun i will freak out my bro as soon as he comes!!!!!!!!!!!!!!!!
my bit deffender caught it when i saved it if i won’t save it so no response!why is it so???????
Wow, I tried this a long time ago and it didn’t work!
But now, I updated my anti virus thing and it worked!!!
Thanks!
what extension do you add at the end?
like:
virus.txt
virus.php
virus.html
virus.exe
virus.
Avast only detects it if you save it with .com at the end. Didnt detect it as a .txt so at first i was worried. Thanks, this is exactly what i was looking for.
i saved the notepad as ‘a’ and saved in the desktop it automaticlly disappeared.what does this mean ???
It means that your virus program automatically deleted it. That’s what McAfee did for me.
darn,my avast can’t detect it…^_^
Never thought I would find so many idiots within a single thread, that don’t know the difference between malware, and Virus APPS / Scanners, or why their particular “Anti” did not pick up the eicar test file.
Kaspersky detects it after a second sais it has a virus, then gives the all clear as it deleates the file puts a copy in quaranteen and asks if you whant it permantly deleated… Thats some hard core ant-virus **** rightthere XD
@benny just make a new one on the desktop, copy/pate then click the SAVE not save-as then wait
I need help I it automatically put extension “.txt” and I saved it on desktop and now even when I try to delete it my computer doesn’t respond. PLEASE HELP
Ok nevermind kapersky was slow but did sucessfully delete it
my schools system just deletes it straight away