This article was co-authored with generative AI. Facts have been checked against public documentation where feasible, but errors may remain. Please verify primary sources before relying on this for important decisions.

In a digital archive SIP (Submission Information Package, the unit of transfer in OAIS) creation workflow, it is common to run format identification (Siegfried) and virus checking (ClamAV) against the transferred set of files. Brunnhilde, used by CCA-Public/sipcreator, is also structured with Siegfried at its core and the option to call ClamAV (it can be disabled with -n/--noclam, and is skipped automatically on Windows).

When I tried to verify this ClamAV by running it standalone on macOS, I encountered the behavior where the EICAR test file used for verification vanished the moment it was placed on disk. At first I thought "macOS's XProtect must have deleted it," but on checking, the cause was something else. I record how it went.

The environment is Apple Silicon (arm64) / Homebrew / ClamAV 1.5.2.

Note: The "vanishes the moment it is placed on disk" phenomenon in this article occurred because my Mac had resident antivirus (Trend Micro Apex One) installed. On a standalone macOS without a resident on-access antivirus, it may not reproduce the same way.

What Is the EICAR Test File

It is a harmless test string for confirming an antivirus's detection behavior without using real malware. Defined by EICAR (European Institute for Computer Antivirus Research), running it merely prints EICAR-STANDARD-ANTIVIRUS-TEST-FILE! and contains no virus code. By convention, many antivirus products detect it as a "virus." The signature itself is the following 68 bytes (per the specification, whitespace and newlines may follow, up to a maximum of 128 bytes treated as a valid EICAR file).

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Setup

Install with Homebrew. Since only *.conf.sample is placed right after installation, create freshclam.conf. If you leave the Example line near the top of the sample as-is, it is treated as "settings unedited" and freshclam/clamd refuse to start, so disable it.

brew install clamav

# create freshclam.conf from the sample (disable the leading Example line)
SAMPLE=$(brew --prefix)/etc/clamav/freshclam.conf.sample
sed 's/^Example/#Example/' "$SAMPLE" > "${SAMPLE%.sample}"

# download virus definitions
freshclam

Running brew install clamav, creating freshclam.conf, and the result of clamscan --version

An ERROR: NULL X509 store warning may appear when running freshclam.

When running freshclam a NULL X509 store warning appears but Database test passed is shown

This is a display reported when running the Homebrew version of ClamAV on macOS (clamav#1421), and if Database test passed. appears, fetching the definitions themselves succeeded. As far as I checked, this issue was closed by the reporter themselves, but not because of a fix by the maintainers or an official "harmless" determination — it appears the reporter withdrew it after migrating to a different tool. I could confirm no actual harm occurred, but it is safest to leave it understood as "cause undetermined."

Placing a File and Scanning Makes It Vanish

When I placed an EICAR file and a normal file and did a directory scan, the following happened. At the point of ls, both files exist, yet clamscan could scan only one file, and scanning the EICAR file by name returned "does not exist."

ls shows 2 files but clamscan scans only 1, and the EICAR file becomes No such file

The file that was visible in ls is gone before clamscan opens it.

Isolating the Cause

I Suspected XProtect, but It Did Not Apply

macOS has built-in malware protection called XProtect, and at first I thought it deleted the file. But re-checking, XProtect does not seem to be a "write-immediate" on-access scanner.

  • XProtect's signature detection (YARA rules) runs on discrete events, such as an app's first launch, file modification, or opening a file with the Gatekeeper quarantine attribute.
  • XProtectRemediatorEicar, which handles EICAR remediation, runs during XProtect Remediator's periodic scans (intervals of several hours to 24 hours); it is not a mechanism that hooks write() to delete in real time.

In fact, looking at XProtect's activity log in the relevant time window, no related entries appeared (the predicate used for observation is below).

log show --last 5m --predicate 'subsystem == "com.apple.XProtectFramework.PluginAPI"'

The Resident Third-Party Antivirus Was the Cause

My Mac had the resident Trend Micro Apex One installed, and it detected the EICAR in an on-access (on-write) scan and quarantined it in real time. The record of the quarantine also remained in the antivirus's own log. Unlike XProtect, EDR (Endpoint Detection and Response) and enterprise endpoint products have an on-access engine that runs triggered by file writes, so the file vanishes before clamscan touches it.

A screenshot of Apex One's (Virus Buster's) quarantine notification and quarantine log is planned to be inserted here.

Just to be sure, I placed three kinds of files at once and observed which remained after 2 seconds (an observation in an environment where resident antivirus is running).

FileContentAfter 2 seconds
benign.txtordinary textsurvived
mentions-eicar.txtcontains the word "EICAR" but is not the signaturesurvived
raw-eicar.txtthe real EICAR signaturedeleted
eicar.b64.txtEICAR base64-encodeddeleted

The file that merely contains the word "EICAR" remained, and only the file containing the real signature vanished. The base64-encoded variant was also deleted. Note that ClamAV itself is known not to detect base64/base32-encoded EICAR (clamav#1332), so this deletion is considered to be the resident antivirus's behavior, not ClamAV's.

As far as I checked, when files vanish on their own, it seems best to first check the resident EDR / enterprise antivirus. Managed Macs may have Apex One, Microsoft Defender, CrowdStrike, and the like running on-access.

Scanning via stdin

If you do not write to disk, it is not subject to the resident antivirus's on-access scan. Feed it from standard input with clamscan - (that - denotes standard input is officially documented behavior).

Passing the EICAR signature to clamscan - with printf detects it as Eicar-Test-Signature FOUND

Eicar-Test-Signature FOUND (exit code 1) appeared, and ClamAV detected it correctly. This confirms that the ClamAV core functions without problems on macOS as well.

ClamAV 1.5.2 is a stable release from 2026-03-04. 1.4.x is LTS and 1.5.x is the feature-stable line, and which one is installed can change depending on the timing of the Homebrew formula update.

Summary

  • ClamAV 1.5.2 works on macOS (Apple Silicon). Setup is three steps: brew install, disabling the Example line in freshclam.conf, and freshclam.
  • The EICAR vanishing the moment it reached the disk was due not to XProtect but to the resident Trend Micro Apex One. When files vanish, it seems best to check the resident antivirus before the OS mechanisms. For test verification, doing it with clamscan - (standard input) avoids being caught by the resident antivirus.
  • On managed macOS, in addition to the OS-level XProtect (event-driven / periodic scan), enterprise EDR's on-access protection may be in effect. For a born-digital-centric, low-risk workflow, a configuration that does not bundle ClamAV into the app itself and instead runs it separately only when needed is also an option.

The ClamAV introduced for verification can be removed with the following command if unnecessary.

brew uninstall clamav