The eicar string is in the right format, because it is recognised by clamav
when sending it as a normal attachment (this was already stated in my first
email). But when sending it as an OLE object inside an excel sheet it is not
detected.
Furthermore I have OLE2 scanning enabled in clamav
Can somebody shine a light on this?
From: Matt Fretwell <[EMAIL PROTECTED]>
Reply-To: ClamAV users ML <clamav-users@lists.clamav.net>
To: ClamAV users ML <clamav-users@lists.clamav.net>
Subject: Re: [Clamav-users] Scanning of ole objects in excel sheet
Date: Tue, 14 Mar 2006 12:05:28 +0000
On Tue, 14 Mar 2006 09:53:42 +0000
"B Boomerang" <[EMAIL PROTECTED]> wrote:
> I have first created an .exe file containing the eicar virus
> string Then I have created an excel sheet and embedded the
> .exe file in it as an OLE object (the object is linked and
> embedded) If I send this excel file as an attachment in an
> email, clamd does not find the eicar virus. (if I send the
> .exe file as an attachment in an email, clamd does find the
> eicar virus)
>
> Is this a bug in clamd or is it by design that the eicar virus
> is not found as an OLE object?
If I remember correctly, the eicar test string has to be in a
very specific format to be recognised as such.
http://www.eicar.com/anti_virus_test_file.htm
Matt
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
