tomb.fish at gmail
Dec 7, 2008, 2:27 PM
Views: 525
Permalink
|
|
clamAV doesn't conform to Eicar standard
|
|
Is that right that clamAV doesn't conform to Eicar Test Virus File standard?
On Eicar page there is a statement:
"Any anti-virus product that supports the EICAR test file should
detect it in any file providing that the file starts with the
following 68 characters, and is exactly 68 bytes long"
I have created new file by appending to Eicar Test Virus file some
binary data & ClamAV still recognize this new file as infected. And
the file is not 68bytes anymore.
Please give me some feedback.
Regards,
Tom
On Sat, Dec 6, 2008 at 1:55 PM, Thomasz Blaszczyk <tomb.fish[at]gmail.com> wrote:
> Thanks Joseph for answer,
>
> The quote appears too restrictive - as I found that the file can be
> longer, as long as it starts with the Eicar.
>
>> "Any anti-virus product that supports the EICAR test file should
>> detect it in any file providing that the file starts with the
>> following 68 characters, and is exactly 68 bytes long"
>>
>> Best Regards,
>> Joseph Benden
>
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
|
clamAV doesn't conform to Eicar standard