[clamav-users] Eicar.com: OK

Noel Jones njones at megan.vbhcs.org
Thu Oct 27 09:26:13 EDT 2016

On 10/27/2016 7:22 AM, wojtunieczek wrote:
> Hi all,
> I've got a problem with a test file detection. I was testing ClamAV on Raspbian, it was detecting EICAR(http://www.eicar.com/download/eicar.com.txt) and removing it with no problem until I quarantined and restored it via ClamTK. Now EICAR files are indicated OK by scanner. I tried to reinstall ClamAV but it didn't help.However, strange thing is that it still founds and removes EICAR files downloaded from secure protocol(https://www.eicar.com/download/eicar.com.txt).
> What might be a reason of this strange behaviour? Is it that quarantine or the secure source of download?
> Thanks for any help
> Wojtek

If I understand your description correctly, clamav still detects
freshly downloaded EICAR, but not longer detects the one previously
quarantined and then released.

Sounds as if the quarantined copy was somehow corrupted.  Maybe
check with the ClamTk folks.

  -- Noel Jones

More information about the clamav-users mailing list