Testing Your Antivirus with PowerShell (Safe EICAR Script)

🛡️ Testing Your Antivirus with PowerShell (Safe EICAR Script)

Sometimes it is difficult to verify whether your antivirus software is actively protecting your system. Using real malware for testing is risky and unsafe. For this reason, the cybersecurity community uses a special testing method known as the EICAR Test File.

The EICAR file is not a real virus. However, it is intentionally designed to be detected as malware by most antivirus solutions. This allows users to safely verify whether their antivirus protection, real-time scanning, and quarantine features are working correctly.

⚙️ PowerShell Antivirus Test Script

The following PowerShell script creates multiple EICAR test files on your system. If your antivirus software is working properly, these files should be detected immediately during creation.

$path = "C:\temp"

if (!(Test-Path $path)) {
    New-Item -ItemType Directory -Path $path
}

$string = "X5O!P%@AP[4\PZX54(P^)7CC)7}`$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!`$H+H*"

for ($i=1; $i -le 50; $i++) {
    Set-Content "$path\eicar_test_$i.txt" $string
}

🔍 What Does This Script Do?

• 1. Checks whether the C:\temp directory exists.
• 2. If the directory does not exist, it automatically creates it.
• 3. Stores the EICAR test string in a variable.
• 4. Uses a loop to attempt creating 50 test files.
• 5. If your antivirus is active, it should detect and block these files.

📊 Expected Results

If your antivirus protection is active and functioning properly, one of the following actions should occur:

• The files are blocked before they are created
• The files are automatically quarantined
• A real-time protection alert appears
• A threat detection entry appears in the security logs

⚠️ Important Notes

• Whenever possible, perform the test inside a virtual machine.
• Be careful when running tests on production servers.
• Clean up the test directory after completing the test.
• Check your antivirus quarantine and event logs.

📝 Conclusion

The EICAR test method is one of the most widely used ways to verify antivirus functionality safely. With this simple PowerShell script, you can quickly confirm whether your security software is actively protecting your system and detecting potential threats.