On Wed, 2 Mar 2022 12:35:40 -0300 Jorge Elissalde via clamav-users <clamav-users@lists.clamav.net> wrote:
> Hi, > > I'm using clamd to make a large data scanning using INSTREAM (data it > is not available as files I could send to clamd). If I send only one > INSTREAM chunk with EICAR inside it is correctly detected, but if I > send several chunks plus EICAR string, it is not detected. > Does it make any sense? I will appreciate any help. You miss the most important point. Eicar test file is very strictly defined at https://www.eicar.org/?page_id=3950 - it very clearly defines which extra characters are allowed after 68 characters string. "The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. The only whitespace characters allowed are the space character, tab, LF, CR, CTRL-Z. To keep things simple the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The only thing to watch out for when typing in the test file is that the third character is the capital letter „O“, not the digit zero." -- Tuomo Soini <t...@foobar.fi> Foobar Linux services +358 40 5240030 Foobar Oy <https://foobar.fi/> _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
