Bogusław Brandys wrote:
Robert L Mathews wrote:>
If anyone is interested, the file I used for testing (which is the EICAR test file appended with 70 KB or so of random data to ensure it's big enough to trigger the decompression failure)
I just tested it with commercial AV: only KAV and NOD can detect it.Strange.
That might be because virus scanners are not required to detect the eicar test file if it contains any extra characters except whitespace, or if it's over 128 bytes in size, according to the eicar site (although some virus scanners, including ClamAV, have no such restriction, so the test with ClamAV was still valid).
Perhaps the other scanners you tried won't ever detect the eicar test data if it's in a file padded with extra data?
-- Robert L Mathews, Tiger Technologies http://www.tigertech.net/ _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
