Comments on: Quickpost: eicar.pdf http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/ (blog 'DidierStevens) Wed, 08 Feb 2012 19:23:01 +0000 hourly 1 http://wordpress.com/ By: Nacho http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-35360 Thu, 16 Jul 2009 09:45:43 +0000 http://didierstevens.wordpress.com/?p=396#comment-35360 Thank you Didier because with this file I could realise that my antivirus had a wrong configuration. I use Avira free and now he is able to detect the pdf and of course the txt.
Keep the good work Didier.

]]> By: nevot http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-35276 Thu, 02 Jul 2009 19:57:08 +0000 http://didierstevens.wordpress.com/?p=396#comment-35276 To Vesselin Bontchev in comment #5
Embedding files in PDFs is just like attaching a file in an email.
Do you expect your antivirus to test attached files, no? So I expect my antivirus to search in embedded files in PDFs too. I think this could be very dangerous, and I want to thank Didier for making such an investigation.

Very good work Didier.

]]> By: Embedding and Hiding Files in PDF Documents - Opsec http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-35258 Wed, 01 Jul 2009 17:22:35 +0000 http://didierstevens.wordpress.com/?p=396#comment-35258 [...] The PDF specification provides ways to embed files in PDF documents. I’m releasing my Python program to create a PDF file with embedded file (I used make-pdf-embedded.py to create my EICAR.pdf). [...]

]]> By: Embedding and Hiding Files in PDF Documents « Didier Stevens http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-35251 Wed, 01 Jul 2009 06:28:37 +0000 http://didierstevens.wordpress.com/?p=396#comment-35251 [...] The PDF specification provides ways to embed files in PDF documents. I’m releasing my Python program to create a PDF file with embedded file (I used make-pdf-embedded.py to create my EICAR.pdf). [...]

]]> By: Didier Stevens http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33816 Wed, 03 Dec 2008 20:25:32 +0000 http://didierstevens.wordpress.com/?p=396#comment-33816 @Clive Smith
That’s what’s your AV is supposed to do.

]]> By: Clive Smith http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33815 Wed, 03 Dec 2008 20:06:42 +0000 http://didierstevens.wordpress.com/?p=396#comment-33815 NOD32 flagged the .pdf as being clean – however when I clicked to export the text file it detected a potential threat and blocked the file from being opened.

]]> By: Venom23 http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33018 Thu, 26 Jun 2008 20:41:40 +0000 http://didierstevens.wordpress.com/?p=396#comment-33018 Would be nice… :)

]]> By: Didier Stevens http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33015 Thu, 26 Jun 2008 18:57:30 +0000 http://didierstevens.wordpress.com/?p=396#comment-33015 I just assembled the PDF file by hand, using a programmers editor.

But now I’ve written some Python code to generate PDF files too. If there is interest, I can cleanup the code and post it.

]]> By: Venom23 http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33013 Thu, 26 Jun 2008 18:43:11 +0000 http://didierstevens.wordpress.com/?p=396#comment-33013 What did you use to construct the PDF?

]]> By: MH http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-32924 Fri, 06 Jun 2008 13:04:50 +0000 http://didierstevens.wordpress.com/?p=396#comment-32924 Foxit reader 2.3 did nothing when you clicked the button.

It sure beats me why this one (lousy) PDF reader called Acrobat seems to be so much more common than the others.

]]>