Eicar.zip not detected + performance stats

[Kevin Spicer]

>I tested a complete setup today and had problems with viruses. I caught
>two real viruses and detected the eicar.com file even though I don't
>really know if it was caught by the filtering of com-files or as a an
>actual virus. When I tested with eicar.com in a zip-file it just
slipped
>through undetected. Zip's are allowed but shouldn't it have been
scanned
>and detected as the Eicar file? Should I be worried? I use an up to
date
>ClamAV. It detects the "virus" if I scan the eicar.zip manually.

I don't know why you're seeing that behaviour, but I really wouldn't
rely on Clam alone.  I use Sophos and Clam at work and F-Prot and Clam
at home.  Clam (although it generally works well) just isn't quick
enough off the mark with new viruses.  Had we been relying on Clam we
would have been flooded with Palyh and Fizzer viruses (assuming they got
past the filename filters...).  I run Clam because a) its free b) I've
got the cycles to spare c) just in case Sophos/ F-Prot pack up.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.