Alex Davidson wrote:
>send myself EICAR test >virus strings but firstly only 3 of the 7 tests hit my mail server, >and secondly ClamAV doesn't detect anything, yet the next-level AV >detects it just fine. I tried to send the 7 tests to my main address... only 3 arrived (the clean one - and 2 of the password protected one) My ISP probably filtered out the others. I can't see ClamAV detecting these two... as it doesn't know the password to decide the insides) eicarpasswd.zip (new! - zip compressed eicar.com with password) eicarpasswdocr.zip (new! - zip compressed eicar.com with password in image file) You could add a signature to detect the above.. but it would ONLY work with the above EICAR test and the SAME password. Cheers, Steve Sanesecurity _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
