From: Robert Hogan <[EMAIL PROTECTED]>
Reply-To: ClamAV users ML <clamav-users@lists.clamav.net>
To: ClamAV users ML <clamav-users@lists.clamav.net>
Subject: Re: [Clamav-users] Scanning of ole objects in excel sheet
Date: Wed, 15 Mar 2006 18:12:10 +0000
On Wednesday 15 March 2006 16:23, Robert Hogan wrote:
> > I have first created an .exe file containing the eicar virus string
> > Then I have created an excel sheet and embedded the .exe file in it as
an
> > OLE object (the object is linked and embedded)
> > If I send this excel file as an attachment in an email, clamd does not
>
> find
>
> > the eicar virus. (if I send the .exe file as an attachment in an
email,
> > clamd does find the eicar virus)
>
> When you unembed the exe from the attachment does it still contain the
full
> eicar string?
>
I meant of course: ' When you unembed the exe from the *spreadsheet* does
it
still contain the full eicar string?'
Yes unembedding the exe from the spreadsheet and opening it in notepad still
shows the eicar string. And the virusscanner on the desktop which received
the email with the excel sheet, triggers on the eicar virus, so it is still
in there. Just try for yourself.
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
