RE: sophie not detecting some viruses

Sophie does not pickup this virus on my system either when scanning the
raw message.  From my experience sophie can't be trusted to scan raw
MIME messages.  But that's why my virus scanner, qmail-scanner, always
unpacks MIME attachments first then scans the attachment file using
sophie. 

---
Ed Henderson
Certainty Tech
814-425-3555 or 800-747-0681
http://www.certainty.net/



> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Markus Stumpf
> Sent: Monday, January 19, 2004 12:39 PM
> To: [email protected]
> Subject: [vtools] sophie not detecting some viruses
> 
> 
> I am running sophie-3.02 on FreeBSD 4.4-RELEASE.
> sophie is linked against (the newest) libsavi.so.3.2.07.040 (3.77b)
> 
> Today I discovered that if using sweep it discovers
>      SWEEP virus detection utility
>      Version 3.77, January 2004 [FreeBSD/Intel]
>      Includes detection for 86890 viruses, trojans and worms
>      Command line qualifiers are: -f -sc -rec -cab -f 
> -archive -loopback -tnef
>      [ ... ]
>      >>> Virus 'Troj/Sefex-A' found in file Profile-720974.html
> 
> However using sophie:
>     /var/qmail/antivirus/bin/scan_file /var/run/sophie 
> $PWD/Profile-720974.html
>     FILE NOT INFECTED: [/tmp/photo/Profile-720974.html]
> 
> All options are set to '1' but
>     Option 'GrpSuper' set to '0'
>     Option 'GrpDisinfect' set to '0'
>     Option 'MaxRecursionDepth' set to '16'
> 
> I have copied the infected file to
>     http://www.space.net/~maex/Profile-720974.html.bin  (19755 bytes)
> 
> Does scanning this file work for you?
> Does anyone have an idea what might be the problem?
> 
> Thanks,
> 	\Maex
> 
> P.S. I am aware we're not running the newest version of sophie, but
>      the fixes don't read like they'd have influence on the problem.
> 
> -- 
> SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 
> (89) 32356-0
> Research & Development |       D-80807 Muenchen    | Fax: +49 
> (89) 32356-299
> "The security, stability and reliability of a computer system 
> is reciprocally
>  proportional to the amount of vacuity between the ears of the admin"
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>