Is that right that clamAV doesn't conform to Eicar Test Virus File standard?
On Eicar page there is a statement: "Any anti-virus product that supports the EICAR test file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long" I have created new file by appending to Eicar Test Virus file some binary data & ClamAV still recognize this new file as infected. And the file is not 68bytes anymore. Please give me some feedback. Regards, Tom On Sat, Dec 6, 2008 at 1:55 PM, Thomasz Blaszczyk <[EMAIL PROTECTED]> wrote: > Thanks Joseph for answer, > > The quote appears too restrictive - as I found that the file can be > longer, as long as it starts with the Eicar. > >> "Any anti-virus product that supports the EICAR test file should >> detect it in any file providing that the file starts with the >> following 68 characters, and is exactly 68 bytes long" >> >> Best Regards, >> Joseph Benden > _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
