-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thierry Zoller wrote: > Antigen.zip (fake compressed size and uncompressed size values) > --------------------------------------------------- > Failed:
<snip> > McAfee 4513 <snip> The Antigen.zip test is flawed. The EICAR test file, by definition, is a maximum of 128 bytes [1]. Technically, it shouldn't even have anything other than the test string and whitespace in it. McAfee picks it up even with garbage rather than whitespace after it, but only if it's small enough (I tested it with the header sizes forged to 127 bytes instead of 255 [2] and McAfee picked it up just fine). Presumably, mindful of the defined limitations of the EICAR test file, McAfee won't pick up EICAR in files >128 bytes in order to avoid complications from EICAR appearing in documents not intended for scanner testing (like [1]). If you really want to find out if scanners are vulnerable to this, you'll probably need to use a real virus in the zip. [1] http://www.eicar.org/anti_virus_test_file.htm [2] You can find the file I used here: http://runawaynet.com/~nknight/avt/Antigen-forgedcrc-fixedsize.zip -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) Comment: Using GnuPG with Red Hat - http://enigmail.mozdev.org iD8DBQFCtwzzUsZlh+GmLlQRAgADAKDFBu6gC+LEXVaholDSPqBZ1Vvq8QCdG97m S+fxK1JfFLRDNa/vQsctTlg= =Jr2u -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/