The string from the EICAR test file has been in the current testnet chain since the start in order to try to spot these issues before they bothered users.

Unfortunately, it appears that AV software completely ignores files larger than 32 MBytes, so it won't notice them in the blockchain— just the chainstate. And so the grand idea of putting the triggers in coinbases didn't work there.

The other fun thing is that the EICAR test trigger is too long to easily stuff in a transaction. Unfortunately there are other "signatures" which are as short as 16 bytes.

16 bytes is the limit?

20 bytes is the limit for what you can stuff into a transaction.

Not sure about mining, but I would assume yes the blockchain is needed.

In order to have a wallet and just use bitcoin no the user does not need to download the whole blockchain depending on the wallet software. There are wallets that use public shared remote servers to access the blockchain that are reputable in the community.

https://electrum.org/

https://multibit.org/

https://darkwallet.unsystem.net/ (don't use yet, alpha)

You don't need the entire blockchain to send/receive. Only when running a "Full node". If you are not intending to keep your node online for 24/7 you can use a SPV style client like Electrum or Multibit. They are lightweight clients without a blockchain attached.

Yes, they do. And yes its quite large! Over 10 GB.

Over 20GB actually, and growing by about 2GB per month.

If you use a client such as Electrum, it uses a server based model to index the Blockchain. The advantage of this is primarily "instant" start up time of the client.

https://electrum.org/

No they don't. Mining software that connects to pools is independent of having a blockchain copy. There are also several bitcoin wallet implementations that don't require a full copy of the blockchain.

Strictly speaking, that is hashing software. Mining software is what runs on the pool, and it absolutely must download and verify the blockchain.