I certaily appreciate your desire to help and educate. My mailserver did not catch either the static or dynamic password protected eicars you provided as the eicar test virus. Yet we are catching/blocking password protected variants of the bagle virus.
What password did you assign to the files? I'd like to unencrypt them if possible. Thanks, Doug ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, March 03, 2004 2:31 PM Subject: Re: [IMail Forum] Correction: *Some* copies of Bagle.J can be caught, otherscannot, regardless of brand of mailserver virus scanner. > > >But it does identify this one as Worm.Bagle.F-zippwd-5 > > Please, please, read the threads fully on a day like this where there is so > much traffic. Especially when an expert keeps telling you that while > several people have claimed otherwise, no AV program is catching dynamic > encoded .ZIP files (all reported cases have been disproven). It's amazing > how many people get caught up in the disinformation and do not believe an > expert, and are sure that they are correct. :) > > As per my previous posts, that file WILL get caught by all AV programs that > are up-to-date. Bagle.F uses static encoded .ZIP files, which get > caught. Bagle.J is the one that uses dynamic encoded .ZIP files. > > Go to http://www.declude.com/tools and uses the Test Virus Sender; if > "eicardynamicencodedzip" doesn't get blocked, you WILL be receiving viruses. > > I'm tempted to offer a reward for anyone who can prove that a mailserver AV > program can detect Bagle.J when it is in a dynamic encoded .ZIP file -- but > doing so will just generate more mis-informed posts. :( > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
