On 10/27/2016 7:22 AM, wojtunieczek wrote: > Hi all, > I've got a problem with a test file detection. I was testing ClamAV on > Raspbian, it was detecting EICAR(http://www.eicar.com/download/eicar.com.txt) > and removing it with no problem until I quarantined and restored it via > ClamTK. Now EICAR files are indicated OK by scanner. I tried to reinstall > ClamAV but it didn't help.However, strange thing is that it still founds and > removes EICAR files downloaded from secure > protocol(https://www.eicar.com/download/eicar.com.txt). > What might be a reason of this strange behaviour? Is it that quarantine or > the secure source of download? > Thanks for any help > Wojtek
If I understand your description correctly, clamav still detects freshly downloaded EICAR, but not longer detects the one previously quarantined and then released. Sounds as if the quarantined copy was somehow corrupted. Maybe check with the ClamTk folks. -- Noel Jones _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
