I have tested it out, and esafe blocked the hole email that contains the eicar virus. Of course I have configure esafe to block virus infected emails instead of modifying them and removing the virus. MegaHz www.megahz.org megahz@xxxxxxxxxx On Sat, 24 Jul 2004 15:27:43 +0400, 3APA3A <3apa3a@xxxxxxxxxxxxxxxx> wrote: > Dear Hugo van der Kooij, > > --Friday, July 23, 2004, 10:21:22 PM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx: > > HvdK> Both as NitroEngine or CVP server they will push as much of 80% to the > HvdK> end-user before they stop a virus. Then they rely on the adding of the > HvdK> exact URL so that URL can be blocked in all next requests. > > It depends on how antiviral check is actually implemented. If connection > is broken immediately after signature is detected - there is no way to > download infected file, because signature will not pass to client and > client will not be able to use "Range:" header to resume partially > downloaded file. > > If antiviral filter checks data _after_ all data received from client > with 20% buffering yes, it's possible to bypass this check for HTTP, > because there is no way (at least for HTTP/1.0 and FTP) to indicate > error to client and make him to delete partially downloaded data. > > You can check it, by sending EICAR with some additional data: if you can > find EICAR signature on the client after connection is broken by > antiviral filter you can bypass it's protection. > > -- > ~/ZARAZA > ÐÐÑÐÐÐ ÐÐÐÐÐÐÐÑÑ ÑÐÐÑÐÐÐÐÐ Ð ÐÐÐÐÑÑÐÐÐÐÐÐÑ ÐÐÐÑÑÐÐÑ, > Ð ÐÐÐÐÐÐ ÑÐÐÐÐÐÐÐÑ 2x2, ÐÐ Ð ÑÐ ÐÑÐ ÑÑÐÐ ÐÑÐÐÐÑÑÑ. (ÐÐÐ) > >
