Dear Bj�rn Scorey, It's expected behaviour. EICAR is executable file and eicar string should only be detected in the beginning of the file.
--Monday, October 4, 2004, 9:33:18 PM, you wrote to [EMAIL PROTECTED]: BS> Hi Everyone ! BS> I am running Suse 9.0 and I have installed� BS> qmail (netqmail��Ver. 1.05) BS> amavis (amavis-new Ver. 20030616p5-23) BS> antivir (Ver 2.08-16)� BS> Antivir seems to be an evaluation version. (The one that came with Suse 9.0)� BS> I donwloaded the EICAR E-Mail Test Virus but when I send either BS> an infected attachment or simply copy the virus string on the mail, BS> the antivirus doesn't recognize the virus, and the mail passes BS> normally.� BS> However when I run antivir on the infected file (attachment) by BS> itself, it recognizes the virus. The same occured with f-prot BS> (however I got some minor errors while installing f-prot). When I BS> run either anti-virus scanner on my mailbox (mbox), none of them BS> manage to see the virus.� BS> Anyone has an idea what's wrong ?� BS> Regards BS> Bj�rn -- ~/ZARAZA ������� ������� ������� ������ - � ���� ������ ����. (����) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
