full-disclosure - [suse-security] Anti-Virus Problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <69326867.20041005113843@SECURITY.NNOV.RU>
From: 3APA3A at SECURITY.NNOV.RU (3APA3A)
Subject: [suse-security] Anti-Virus Problem

Dear Bj?rn Scorey,

It's  expected  behaviour.  EICAR  is  executable  file and eicar string
should only be detected in the beginning of the file.

--Monday, October 4, 2004, 9:33:18 PM, you wrote to full-disclosure@...ts.netsys.com:

BS> Hi Everyone !

BS> I am running Suse 9.0 and I have installed?

BS> qmail (netqmail??Ver. 1.05) 
BS> amavis (amavis-new Ver. 20030616p5-23) 
BS> antivir (Ver 2.08-16)?

BS> Antivir seems to be an evaluation version. (The one that came with Suse 9.0)?

BS> I donwloaded the EICAR E-Mail Test Virus but when I send either
BS> an infected attachment or simply copy the virus string on the mail,
BS> the antivirus doesn't recognize the virus, and the mail passes
BS> normally.?

BS> However when I run antivir on the infected file (attachment) by
BS> itself, it recognizes the virus. The same occured with f-prot
BS> (however I got some minor errors while installing f-prot). When I
BS> run either anti-virus scanner on my mailbox (mbox), none of them
BS> manage to see the virus.?

BS> Anyone has an idea what's wrong ??

BS> Regards 
BS> Bj?rn 

-- 
~/ZARAZA
??????? ??????? ??????? ?????? - ? ???? ?????? ????. (????)