[Avcheck] Scan only incomming msg

Michael Tokarev mjt@tls.msk.ru
Sun, 13 Jan 2002 22:42:19 +0300


Michael Tokarev wrote:
> 
[]
> > Content-Type: text/plain;
> >   name="eicar.com"
> > Content-Transfer-Encoding: 7bit
> > Content-Disposition: inline;
> >   filename="eicar.com"
> 
> This looks suspicious to me.  Content-Type: text/plain, that is.  Please
> try the same with e.g. application/octet-stream.

I just verified this with avp.  Yes, avp will NOT detect eicar "virus"
if encoded as "text/plain" like in this case.  Please take a look into
eicar.msg test file as distributed with avcheck -- there are some comments
about this in that file.

> Regards,
>  Michael.