Hi, The weird part is that Avira and other Antivirus correctly are able to detect EICAR in any case, having other characters before and/or after the EICAR string. Thank you,
El jue, 3 mar 2022 a las 12:27, Tuomo Soini via clamav-users (< clamav-users@lists.clamav.net>) escribió: > On Wed, 2 Mar 2022 12:35:40 -0300 > Jorge Elissalde via clamav-users <clamav-users@lists.clamav.net> wrote: > > > Hi, > > > > I'm using clamd to make a large data scanning using INSTREAM (data it > > is not available as files I could send to clamd). If I send only one > > INSTREAM chunk with EICAR inside it is correctly detected, but if I > > send several chunks plus EICAR string, it is not detected. > > > Does it make any sense? I will appreciate any help. > > You miss the most important point. Eicar test file is very strictly > defined at https://www.eicar.org/?page_id=3950 - it very clearly > defines which extra characters are allowed after 68 characters string. > > "The first 68 characters is the known string. It may be optionally > appended by any combination of whitespace characters with the total > file length not exceeding 128 characters. The only whitespace > characters allowed are the space character, tab, LF, CR, CTRL-Z. To > keep things simple the file uses only upper case letters, digits and > punctuation marks, and does not include spaces. The only thing to watch > out for when typing in the test file is that the third character is the > capital letter „O“, not the digit zero." > > -- > Tuomo Soini <t...@foobar.fi> > Foobar Linux services > +358 40 5240030 > Foobar Oy <https://foobar.fi/> > > _______________________________________________ > > clamav-users mailing list > clamav-users@lists.clamav.net > https://lists.clamav.net/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml >
_______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
