On Mon, 15 Mar 2004, Martin A. Brooks wrote: ; Part of the text file is a boilerplate set of instructions on how to make ; an EICAR test file. Clam detects this signature and marks the file as ; being infected. NAI and Norton AV do not. ; ; I'm undecided as to which action is correct and would therefore appreciate ; other opinions.
Clam's behaviour is incorrect because the Eicar test file page (http://www.eicar.org/anti_virus_test_file.htm) states: "Any anti-virus product that supports the test file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long:" I don't know whether the limitation is in Clam's current database format or in the current signature. Andy ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
