[Avcheck] eicar.com.txt not detected?

Michael Tokarev mjt@tls.msk.ru
Sat, 16 Feb 2002 17:08:30 +0300


Piotr KUCHARSKI wrote:
> 
> On Sat, Feb 16, 2002 at 02:20:33PM +0300, Michael Tokarev wrote:
> > Change text/plain to application/octet-stream.  There is no need to detect
> > eicar if comes as text.
> 
> I hope it is just eicar specific? Otherwise circumvention would be
> too easy ;-)

I think that until some new virus (that will require antivirus bases update
anyway) will actually use harmful text/plain attachment, there is no *real*
need to check such attachments anyway.  BTW, most infected .exe files are
detected anyway regardless of mime type.  You can do some expiriments --
find a virus and play with mime headers around it and see what will happen.
This is even funny enouth.. ;)

Regards,
 Michael.