On Sat, 28 Feb 2004, Andrea Gabellini wrote: > At 09.04 28/02/2004, you wrote: > >I came across testvirus.org yesterday (a simple way to email yourself > >various ways of encoding EICAR) and was fairly happy with the result. > > I'm using sophos and it didn't catch the binhex encoded virus.
Same here, and it also passed through the "space gap" test too - however, the file that I saved was not eicar.com! Either pine mis-decoded it, or they wrongly encoded it at source. A "real" copy of eicar.com: gordon @ lion: od -x eicar.com 0000000 3558 214f 2550 4140 5b50 5c34 5a50 3558 0000020 2834 5e50 3729 4343 3729 247d 4945 4143 0000040 2d52 5453 4e41 4144 4452 412d 544e 5649 0000060 5249 5355 542d 5345 2d54 4946 454c 2421 0000100 2b48 2a48 000a The version pine saved from the "space gap" test: gordon @ unicorn: od -x eicar.com 0000000 6559 5996 9665 6559 5996 9665 6559 5996 0000020 9665 6559 5996 9665 6559 5996 9665 6559 0000040 5996 9665 6559 5996 9665 6559 5996 9665 0000060 6559 5996 9665 6559 5996 9665 6559 5996 0000100 9665 2a48 0020 So somethings wring somewhere.. Gordon _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang