Comments on: Quickpost: eicar.pdf http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/ (blog 'DidierStevens) Tue, 06 Jan 2009 13:06:56 +0000 http://wordpress.org/?v=MU hourly 1 By: Didier Stevens http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33816 Didier Stevens Wed, 03 Dec 2008 20:25:32 +0000 http://didierstevens.wordpress.com/?p=396#comment-33816 @Clive Smith That’s what’s your AV is supposed to do. @Clive Smith
That’s what’s your AV is supposed to do.

]]> By: Clive Smith http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33815 Clive Smith Wed, 03 Dec 2008 20:06:42 +0000 http://didierstevens.wordpress.com/?p=396#comment-33815 NOD32 flagged the .pdf as being clean - however when I clicked to export the text file it detected a potential threat and blocked the file from being opened. NOD32 flagged the .pdf as being clean - however when I clicked to export the text file it detected a potential threat and blocked the file from being opened.

]]> By: Venom23 http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33018 Venom23 Thu, 26 Jun 2008 20:41:40 +0000 http://didierstevens.wordpress.com/?p=396#comment-33018 Would be nice... :) Would be nice… :)

]]> By: Didier Stevens http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33015 Didier Stevens Thu, 26 Jun 2008 18:57:30 +0000 http://didierstevens.wordpress.com/?p=396#comment-33015 I just assembled the PDF file by hand, using a programmers editor. But now I've written some Python code to generate PDF files too. If there is interest, I can cleanup the code and post it. I just assembled the PDF file by hand, using a programmers editor.

But now I’ve written some Python code to generate PDF files too. If there is interest, I can cleanup the code and post it.

]]> By: Venom23 http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-33013 Venom23 Thu, 26 Jun 2008 18:43:11 +0000 http://didierstevens.wordpress.com/?p=396#comment-33013 What did you use to construct the PDF? What did you use to construct the PDF?

]]> By: MH http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-32924 MH Fri, 06 Jun 2008 13:04:50 +0000 http://didierstevens.wordpress.com/?p=396#comment-32924 Foxit reader 2.3 did nothing when you clicked the button. It sure beats me why this one (lousy) PDF reader called Acrobat seems to be so much more common than the others. Foxit reader 2.3 did nothing when you clicked the button.

It sure beats me why this one (lousy) PDF reader called Acrobat seems to be so much more common than the others.

]]> By: Didier Stevens http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-32885 Didier Stevens Tue, 27 May 2008 10:23:58 +0000 http://didierstevens.wordpress.com/?p=396#comment-32885 I'm very familiar with the EICAR Test File, and I didn't write that I expected AV products to detect the EICAR.pdf file. But I expect that the AV products detect the eicar.txt that is exported when you click on the button. What made you believe that I wanted the eicar.pdf to be detected by AV products? I’m very familiar with the EICAR Test File, and I didn’t write that I expected AV products to detect the EICAR.pdf file. But I expect that the AV products detect the eicar.txt that is exported when you click on the button.

What made you believe that I wanted the eicar.pdf to be detected by AV products?

]]> By: Vesselin Bontchev http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-32884 Vesselin Bontchev Tue, 27 May 2008 10:16:09 +0000 http://didierstevens.wordpress.com/?p=396#comment-32884 Please read the definition of the EICAR Test File on the EICAR Web site. The file *must* be a text file, with the specified 68-character sequence at the beginning and no more than 128 bytes of whitespace after it. If you make anything else (e.g., embed this character sequence in PDF files, Word files or whatnot), then the result is no longer the EICAR Test File and you can't reasonably expect the anti-virus programs to detect it (although some will under some circumstances). Please read the definition of the EICAR Test File on the EICAR Web site. The file *must* be a text file, with the specified 68-character sequence at the beginning and no more than 128 bytes of whitespace after it. If you make anything else (e.g., embed this character sequence in PDF files, Word files or whatnot), then the result is no longer the EICAR Test File and you can’t reasonably expect the anti-virus programs to detect it (although some will under some circumstances).

]]> By: Didier Stevens http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-32870 Didier Stevens Thu, 22 May 2008 19:54:53 +0000 http://didierstevens.wordpress.com/?p=396#comment-32870 That's what's your AV is supposed to do. That’s what’s your AV is supposed to do.

]]> By: Ilmar http://blog.didierstevens.com/2008/05/20/quickpost-eicarpdf/#comment-32869 Ilmar Thu, 22 May 2008 19:40:08 +0000 http://didierstevens.wordpress.com/?p=396#comment-32869 Opened the file and clicked the button... verified that I wanted to open file.... Symantec Antivirus v10.1.0.401 (with up to date DATs) AutoProtect deleted the file before Notepad could open it... therefore received a "file not found error". Opened the file and clicked the button… verified that I wanted to open file…. Symantec Antivirus v10.1.0.401 (with up to date DATs) AutoProtect deleted the file before Notepad could open it… therefore received a “file not found error”.

]]>