[clamav-users] INSTREAM + eicar not well detected?

[Tuomo Soini]

On Thu, 3 Mar 2022 22:50:04 -0300
Jorge Elissalde via clamav-users <clamav-users at lists.clamav.net> wrote:

> Hi,
> 
> The weird part is that Avira and other Antivirus correctly are able to
> detect EICAR in any case, having other characters before and/or after
> the EICAR string.

That is incorrectly detecting it. They must not detect signature in the
middle. That's clearly in specification. Long time ago there was big
discussion about eicar detection and at that time ClamAV got fixed not
to incorrectly detect eicar signature in the middle of other data.

-- 
Tuomo Soini <tis at foobar.fi>
Foobar Linux services
+358 40 5240030
Foobar Oy <https://foobar.fi/>