From: 3APA3A (3APA3ASECURITY.NNOV.RU)
Date: Tue Oct 05 2004 - 02:38:43 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Dear Björn Scorey,

It's expected behaviour. EICAR is executable file and eicar string
should only be detected in the beginning of the file.

--Monday, October 4, 2004, 9:33:18 PM, you wrote to full-disclosurelists.netsys.com:

BS> Hi Everyone !

BS> I am running Suse 9.0 and I have installed 

BS> qmail (netqmail  Ver. 1.05)
BS> amavis (amavis-new Ver. 20030616p5-23)
BS> antivir (Ver 2.08-16) 

BS> Antivir seems to be an evaluation version. (The one that came with Suse 9.0) 

BS> I donwloaded the EICAR E-Mail Test Virus but when I send either
BS> an infected attachment or simply copy the virus string on the mail,
BS> the antivirus doesn't recognize the virus, and the mail passes
BS> normally. 

BS> However when I run antivir on the infected file (attachment) by
BS> itself, it recognizes the virus. The same occured with f-prot
BS> (however I got some minor errors while installing f-prot). When I
BS> run either anti-virus scanner on my mailbox (mbox), none of them
BS> manage to see the virus. 

BS> Anyone has an idea what's wrong ? 

BS> Regards
BS> Björn

--
~/ZARAZA
Êëÿíóñü ëûñèíîé ïðîðîêà Ìîèñåÿ - ÿ òåáÿ ñåé÷àñ ñúåì. (Òâåí)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]