[Mimedefang] TESTVIRUS.org - test question

[Gordon Henderson]

On Sat, 28 Feb 2004, Andrea Gabellini wrote:

> At 09.04 28/02/2004, you wrote:
> >I came across testvirus.org yesterday (a simple way to email yourself
> >various ways of encoding EICAR) and was fairly happy with the result.
>
> I'm using sophos and it didn't catch the binhex encoded virus.

Same here, and it also passed through the "space gap" test too - however,
the file that I saved was not eicar.com! Either pine mis-decoded it, or
they wrongly encoded it at source.

A "real" copy of eicar.com:

gordon @ lion: od -x eicar.com
0000000 3558 214f 2550 4140 5b50 5c34 5a50 3558
0000020 2834 5e50 3729 4343 3729 247d 4945 4143
0000040 2d52 5453 4e41 4144 4452 412d 544e 5649
0000060 5249 5355 542d 5345 2d54 4946 454c 2421
0000100 2b48 2a48 000a

The version pine saved from the "space gap" test:

gordon @ unicorn: od -x eicar.com
0000000 6559 5996 9665 6559 5996 9665 6559 5996
0000020 9665 6559 5996 9665 6559 5996 9665 6559
0000040 5996 9665 6559 5996 9665 6559 5996 9665
0000060 6559 5996 9665 6559 5996 9665 6559 5996
0000100 9665 2a48 0020

So somethings wring somewhere..

Gordon