How to Check If Your Antivirus Is Actually Working (3 Quick Tests)

By Alex Morgan, Cloud Security Researcher
Last Updated: May 2026 · 6 min read

Your antivirus icon sits in the system tray, a reassuring green checkmark. "You're protected," it says. But when did you last verify that claim? A silent failure — real-time protection disabled after an update, virus definitions stuck for weeks — can leave you exposed without any visible warning. Here are three completely safe tests that take five minutes total and will confirm whether your antivirus is actually doing its job.

Test 1: The EICAR Test File (Completely Safe)

The EICAR Anti-Malware Testfile is a harmless string of characters that all reputable antivirus programs agree to treat as a test threat. It's not a virus — it's a standard developed by the European Institute for Computer Anti-Virus Research to safely verify that antivirus software is functioning.

How to run it: Visit eicar.org and attempt to download the file. Your antivirus should block the download immediately — either by quarantining the file and displaying a warning, or by preventing the connection entirely. If the download completes without any reaction, your real-time web protection isn't working.

What this tests: Real-time web scanning. The AV must intercept the file before it even lands on your disk. A delayed detection (when you try to open the file instead of during download) indicates on-access scanning is working but real-time web protection is not.

Test 2: Real-Time File Scanning Verification

This test confirms your antivirus scans files as they're created or modified — not just during scheduled full scans. Create a simple text file and save the EICAR string inside it.

How to run it:

  1. Open Notepad (Windows) or TextEdit (Mac, plain text mode).
  2. Paste this exact string (one line, no spaces before or after):
    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
  3. Save the file as test.com or test.txt on your Desktop.

If your antivirus is working, it will quarantine or delete the file instantly upon saving — sometimes before you even close Notepad. Windows Defender, for example, removes the file within one second of clicking "Save." If nothing happens, right-click the file and select "Scan with [your AV]" — if it still doesn't detect it, your virus definitions are outdated or the product isn't functioning.

Test 3: Phishing & Malicious Website Protection

Modern antivirus suites include web protection that blocks known phishing sites and malware-hosting domains. The Anti-Malware Testing Standards Organization (AMTSO) maintains a safe testing page to verify this feature.

How to run it: Visit AMTSO's Security Features Check. Scroll to "Check Web Protection" or "Phishing Test" and click the provided test link. Your browser should display a warning that the site is dangerous, or your antivirus should intercept the connection before the page loads. If the page opens without any warning, your web protection isn't functioning — or you don't have any browser-level protection enabled.

Note: Microsoft Defender's network protection requires SmartScreen to be enabled in Windows Security. Third-party AVs often install browser extensions — make sure those are active. If you've disabled browser extensions thinking they're bloatware, you may have unintentionally disabled web protection.

What to Do If Your AV Fails Any Test

  1. Check real-time protection: Open your antivirus interface. Sometimes a recent update disables real-time scanning silently. Turn it back on.
  2. Update virus definitions: Manually check for updates. Offline definitions can be weeks old.
  3. Restart your computer: A surprising number of AV failures are resolved with a reboot — especially after Windows updates.
  4. Check for conflicting software: Running two full antivirus products simultaneously cripples both. Uninstall one.
  5. If still failing, switch: If your current AV can't pass these basic tests, it's time to replace it. Consult our tested guide: Best Free Antivirus That Won't Annoy You with Ads.

I run these three tests every time I install a new AV. It's part of my standard review process. On two occasions, a "green checkmark" product failed Test 2 — real-time file scanning was silently off after an update. Both were fixed with a reboot, but without the test, I wouldn't have known for weeks. Five minutes. Do it now.

Some links may be affiliate links. See our Affiliate Disclosure.

Questions about antivirus testing? Reach us at contact@viperstream.cloud.