>My problem with f-prot was with email attachments like anna but not just
>anna. I asked f-prot about it and they replied that "it only worked with
>Outlook". I think what they meant that if I had been running their windows
>product it might have caught it if I tried to open the anna file.
You might want to try v1.14 with F-Prot, if you haven't yet. It's possible
that McAfee was able to catch viruses in files that were slightly different
than the way the virus was originally created (for example, a carriage
return and linefeed (CRLF) instead of just a carriage return (CR)).
But I was impressed that McAfee was able to catch the "Anna" virus as soon
as it hit on Monday.
>Unless there is something I'm missing I can't make either f-prot or
>InoculateIt catch anna in any format I've tried.
You may want to check our "Test Mail Sender" at
http://www.declude.com/tools , and use the "eicarquoted" one, and make sure
it gets caught. If properly decoded, it will get caught by the virus scanner.
>McAffee command line on the other hand found it from the beginning but
>declude didn't act properly until Scott fixed it.
Actually, it would depend on the specific encoding type used. Most viruses
are spread using the MIME base64 encoding type. This one was sometimes
sent using base64, and sometimes using the "quoted-printable" type, which
had varying results.
-Scott
[ This E-mail came from the Declude.Virus mailing list. To ]
[ unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ]
[ type "unsubscribe Declude.Virus yourname". You can E-mail ]
[ [EMAIL PROTECTED] for assistance. You can visit our web ]
[ site at http://www.declude.com . ]
