[clamav-users] Generating a positive?

[Charles Swiger]

Hi--

On Apr 21, 2014, at 12:12 PM, Dave Shevett <shevett at pobox.com> wrote:
> Hi everyone - we have clamav now running happily via cron job and
> integrated with puppet.  Problem is I want to have it successfully find
> something so I can test our notification mechanism.
> 
> "Infect one of my servers" seems a big gruesome.  Is there an easy way
> to test clamav notifications (like a simple test rule that says "if
> there's a file called BOB here, you're infected with the BOBSMASH virus?"

You want to use the EICAR test file:

  http://en.wikipedia.org/wiki/EICAR_test_file

It's a harmless test file which is also a working 16-bit COM file:

% clamscan eicar.com
eicar.com: Eicar-Test-Signature FOUND

Regards,
-- 
-Chuck