[Avcheck] eicar.com.txt not detected?
Michael Tokarev
mjt@tls.msk.ru
Sat, 16 Feb 2002 17:08:30 +0300
Piotr KUCHARSKI wrote:
>
> On Sat, Feb 16, 2002 at 02:20:33PM +0300, Michael Tokarev wrote:
> > Change text/plain to application/octet-stream. There is no need to detect
> > eicar if comes as text.
>
> I hope it is just eicar specific? Otherwise circumvention would be
> too easy ;-)
I think that until some new virus (that will require antivirus bases update
anyway) will actually use harmful text/plain attachment, there is no *real*
need to check such attachments anyway. BTW, most infected .exe files are
detected anyway regardless of mime type. You can do some expiriments --
find a virus and play with mime headers around it and see what will happen.
This is even funny enouth.. ;)
Regards,
Michael.