Write the smallest program which triggers the virus alarm of at least two major (and different) anti-virus programs. Different versions of the same scanner, or two companies selling basically the same engine or variants thereof don't count as different.
Using the EICAR test file or similar file explicitly created as a test pattern, either directly or indirectly, will double your code size.
Your program is not required to (try to) do actual damage to the system. Just triggering the scanner to detect it as a virus/malware is enough. However, if the scanner just asks about all unknown programs "are you sure you want to run this?", it is not enough.
Standard code golf rules apply, no downloading pre-defined files, etc. All behavior must be included in your program.
Your program must work without crashing in the event no anti-malware program is running on the system.