[Avcheck] Problem (what else?)

[Milan P. Stanic]

On 28-Aug-2001 Ralf Hildebrandt wrote:
> But not encoded as mail. Remeber, a mail starts with headers!
> Try this:
> 
> /var/spool/avp/avcheck -n -f root -d /var/spool/avp/./tst \ 
> -s avp:/var/spool/avp/ctl/AvpCtl root < eicar.msg
> 
> where eicar.msg is a "real" mail message, e.g. with headers and
> encoding etc.

OK.

root@dl:~# /var/spool/avp/avcheck -n -f root -d /var/spool/avp/./tst -s
avp:/var/spool/avp/ctl/AvpCtl root < eicar.msg
Message didn't pass the virus check: infected: EICAR-Test-File

And now (something totally different ;) ) EICAR.TXT

root@dl:~# /var/spool/avp/avcheck -n -f root -d /var/spool/avp/./tst -s
avp:/var/spool/avp/ctl/AvpCtl root < eicar.txt
Message didn't pass the virus check: infected: EICAR-Test-File

That confused me. AvpDaemon detects virus in text file if avcheck is
invoked through the shell. And I thought that it must detect it when I send
the same file in the body of message (over SMTP, of course).

Best Regards,

Milan