如何安全创建用于文件扫描器测试的感染型.docx/.pdf/.xls文件？

Great question—testing antivirus scanners with safe, non-malicious "infected" files is crucial, and embedding the EICAR test string into Office or PDF documents is totally doable without risking your system. Here's how to create each format safely:

.docx files are just ZIP archives under the hood, so we can sneak the EICAR string into the package without breaking the document:

• First, create a plain text file named eicar.txt and paste the official EICAR test string:

  X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
  

• Make a blank .docx document in Word, type a throwaway line like "Test Document" to ensure it's valid, then save and close it.
• Rename the .docx file to .zip (you might need to enable file extension visibility in your OS settings).
• Extract the ZIP contents to a folder.
• Drop your eicar.txt file into the extracted word/ subfolder (or the root of the extracted files—either works).
• Re-zip the extracted folder back into a ZIP file, then rename it back to .docx.

This .docx will open normally in Word, but antivirus tools will flag it as "infected" due to the EICAR string embedded inside.

You have two reliable options here:

Option 1: Generate a Minimal Valid PDF with EICAR #

Create a new text file and paste this valid PDF structure that includes the EICAR string directly in the content stream:

%PDF-1.7
1 0 obj
<< /Type /Catalog /Pages 2 0 R >>
endobj
2 0 obj
<< /Type /Pages /Kids [3 0 R] /Count 1 >>
endobj
3 0 obj
<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R >>
endobj
4 0 obj
<< /Length 54 >>
stream
BT /F1 12 Tf 100 700 Td (X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*) Tj ET
endstream
endobj
5 0 obj
<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>
endobj
xref
0 6
0000000000 65535 f 
0000000010 00000 n 
0000000079 00000 n 
0000000173 00000 n 
0000000279 00000 n 
0000000457 00000 n 
trailer
<< /Size 6 /Root 1 0 R >>
startxref
565
%%EOF

Save the file with a .pdf extension—this is a fully functional PDF that will trigger antivirus alerts but is completely safe.

Option 2: Attach EICAR to an Existing PDF #

Use a free PDF tool (like PDF24 Creator) to add your eicar.txt file as an attachment to a blank PDF. Most antivirus scanners will detect the embedded EICAR string in the attachment.

The method depends on whether you're using the old .xls format or the newer .xlsx format:

• For .xlsx: Use the exact same ZIP archive method as we did for .docx—extract the .xlsx (rename to .zip), drop eicar.txt into the xl/ subfolder, re-zip, and rename back to .xlsx.
• For .xls: Open a blank .xls file in Excel, go to Insert > Object > Create from File, select your eicar.txt, check "Display as icon", then save the file. The embedded text file will trigger antivirus scans without harming your system.

Key Notes #

• All these files are 100% safe—they only contain the EICAR test string, which is a standardized, non-malicious marker designed specifically for antivirus testing. No real malware is involved.
• Some antivirus tools might block the file during creation. If this happens, temporarily disable real-time protection (only in a safe testing environment) or work in a folder your antivirus has marked as trusted.
• Don't forget to delete these test files once you're done to avoid accidental alerts later.

内容的提问来源于stack exchange，提问作者IOException