clamd matches EICAR only at the start of a file, so a %PDF- check ahead of the scan made the infected path unreachable for the EICAR test file. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>