Re: OT: Eicar Test

Hello Peter,

Sunday, November 21, 2004, 09:43:37, you wrote:

PM> Hi there,

PM> I just found that the mailing list server doesn't accept a virus text
PM> string in the body (tried Eicar), which I consider a very good thing.
PM> Thank you, Johannes! :-)

PM> But how about a virus code coming with a different character set? I'm
PM> just curious... ;-)

PM> (taken out so that this messages flows everywhere)


huh... EICAR should be caugth if it is the ONLY string in the message.
Otherwise, it should NOT be caugth.

The reason is that EICAR is a TEST string to verify an AV. If the AV
programme gets this string, and NOTHING ELSE, then it should trip.
Otherwise, this is not the EICAR anymore, and the AV should NOT trip.

In other words... tripping on the above message only shows that the AV
in use is not correctly tripping on EICAR :-)

-- 

 ..hggdh..

Using The Bat! v3.0.2.6 and Bayes Filter Plugin v1.5.6 on Windows 2000 5.0 Build  2195
Service Pack 4