[Snort-inline-users] Eicar and ClamAV

[Will M. <wil...@gm...>]

It seems as if the clam guy's updated the signature database with a
new definition for Eicar, and it is no longer detected in the same
manner.  I was wrong, about Clam being broken as it still seems to
pick-up other virii ok.  In addition, it appears as if Victor thinks
he has figured out a way to scan file descriptors via writing packet
contents to tmp files.  We actually should be able to detect more
virii using this method.

Regards,

Will