Use of EICAR AV test string in signatures

[wesley at mcgrewsecurity.com (Robert Wesley McGrew)]

On Wed, May 19, 2010 at 9:48 PM, Rob Fuller <jd.mubix at gmail.com> wrote:
> Experiment?over. thanks, and sorry for the?inconvenience. If, as you say,
> you combed your spam and found the email, you should have known who to talk
> to. But I understand the detriment to the list, as there might be others
> also missing out.
> Oh, and that AV you are using, technically shouldn't be finding EICAR in
> non-binary form, if I remember the purpose of it. I could be wrong.

All of the (68) bytes in eicar.com are printable ASCII, so it would be
difficult for AV to tell, without opening up the possibility of false
negatives.

-- 
Wesley McGrew
http://mcgrewsecurity.com