testfile: Eicar-Test-Signature FOUND ----------- SCAN SUMMARY ----------- Known viruses: 1773 Scanned directories: 0 Scanned files: 1 Data scanned: 0.95 Mb Infected files: 1 I/O buffer size: 131072 bytes Time: 0.245 sec (0 m 0 s)The unique string in this output is "Eicar-Test-Signature". Run sigtool with the following parameters:
$ sigtool -c "clamscan --stdout" -f testfile -s "Eicar-Test"The program will concatenate arguments for -c (-command) and -f (-file), that's why the scanner's options must be given in the proper order. At the end it will generate a file testfile.sig, which should contain 80 bytes in our example. It contains the proper signature.