Add a failing spec for `is_eicar_corrupted`?

This will let Travis catch problems with eicar check. The check should pass once #4068 is fixed.
be_falsey is preferred