Re: OT: Eicar Test

Hi Johannes,

on Sun, 21 Nov 2004 17:07:03 +0100GMT, you wrote:

JMP> On Sun, 21 Nov 2004 16:43:37 +0100, Peter Meyns <lists@xxx> wrote:

>> I just found that the mailing list server doesn't accept a virus text
>> string in the body (tried Eicar), which I consider a very good thing.
>> Thank you, Johannes! :-)

JMP> 2004-11-21 16:05:29 1CVtHN-0003c1-0v H=moutng.kundenserver.de
JMP> [212.227.126.171] F=<lists@xxx> rejected after DATA: This message
JMP> contains malware (Eicar-Test-Signature)

Yes, exactly, that's the one I meant.

>> But how about a virus code coming with a different character set? I'm
>> just curious... ;-)

JMP> It seems neither our ClamAV nor your providers 

JMP> X-Antivirus: avast! (VPS 0447-1, 19.11.2004), Outbound message
JMP> X-Antivirus-Status: Clean

JMP> caught it. ;-) Strictly speaking, this is not a problem because the
JMP> antivirus usually only scans (MIMEd) attachments. When copying the
JMP> EICAR virus test code, your local antivirus will warn you.

Yes, that's what I thought. I don't really believe, someone will try
to distribute virus codes via ROT13, nor that someone on these lists
might be interested in receiving them. It was a rather academically
thought of mine... ;-)

-- 
Cheers
Peter

The Bat! v3.0.2.7 on Win2K, SP4, 5, 0, build 2195,
AMD Athlon 2200+ at 1800MHz, 512 MB RAM