Comments on: Quickpost: New EICARgen Version http://blog.didierstevens.com/2009/12/04/quickpost/ (blog 'DidierStevens) Thu, 29 Jul 2010 03:37:46 +0000 hourly 1 http://wordpress.com/ By: Ange http://blog.didierstevens.com/2009/12/04/quickpost/#comment-37401 Ange Thu, 07 Jan 2010 13:33:14 +0000 http://blog.didierstevens.com/?p=1869#comment-37401 my eicar source @ http://corkami.blogspot.com/2009/12/this-is-not-virus.html my eicar source @ http://corkami.blogspot.com/2009/12/this-is-not-virus.html

]]> By: Didier Stevens http://blog.didierstevens.com/2009/12/04/quickpost/#comment-36755 Didier Stevens Sat, 05 Dec 2009 09:40:58 +0000 http://blog.didierstevens.com/?p=1869#comment-36755 Good point, a generic dropper signature could explain what AVG does. And I could also use a downloader, thanks for the tip. Good point, a generic dropper signature could explain what AVG does. And I could also use a downloader, thanks for the tip.

]]> By: kurt wismer http://blog.didierstevens.com/2009/12/04/quickpost/#comment-36742 kurt wismer Fri, 04 Dec 2009 22:16:02 +0000 http://blog.didierstevens.com/?p=1869#comment-36742 while it's true that the specs for eicar say that any file that starts with the specified 68 characters should be detected, that doesn't preclude them from detecting droppers. it's reasonable to assume that some anti-malware programs will detect not only known malware but also generically detect droppers of known malware, which would apply to this case. maybe instead of a dropper you should try a downloader (perhaps that's why downloaders rose to prominence). while it’s true that the specs for eicar say that any file that starts with the specified 68 characters should be detected, that doesn’t preclude them from detecting droppers.

it’s reasonable to assume that some anti-malware programs will detect not only known malware but also generically detect droppers of known malware, which would apply to this case.

maybe instead of a dropper you should try a downloader (perhaps that’s why downloaders rose to prominence).

]]>