Re: sophie not detecting some viruses

Renato <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
I tried with version 3.76 and sweep detects the virus,
while Sophie doesn't... this is not good at all.

--- Markus Stumpf
<[email protected]> wrote:
> I am running sophie-3.02 on FreeBSD 4.4-RELEASE.
> sophie is linked against (the newest)
> libsavi.so.3.2.07.040 (3.77b)
> 
> Today I discovered that if using sweep it discovers
>      SWEEP virus detection utility
>      Version 3.77, January 2004 [FreeBSD/Intel]
>      Includes detection for 86890 viruses, trojans
> and worms
>      Command line qualifiers are: -f -sc -rec -cab
> -f -archive -loopback -tnef
>      [ ... ]
>      >>> Virus 'Troj/Sefex-A' found in file
> Profile-720974.html
> 
> However using sophie:
>     /var/qmail/antivirus/bin/scan_file
> /var/run/sophie $PWD/Profile-720974.html
>     FILE NOT INFECTED:
> [/tmp/photo/Profile-720974.html]
> 
> All options are set to '1' but
>     Option 'GrpSuper' set to '0'
>     Option 'GrpDisinfect' set to '0'
>     Option 'MaxRecursionDepth' set to '16'
> 
> I have copied the infected file to
>    
> http://www.space.net/~maex/Profile-720974.html.bin 
> (19755 bytes)
> 
> Does scanning this file work for you?
> Does anyone have an idea what might be the problem?
> 
> Thanks,
> 	\Maex
> 
> P.S. I am aware we're not running the newest version
> of sophie, but
>      the fixes don't read like they'd have influence
> on the problem.
> 
> -- 
> SpaceNet AG            | Joseph-Dollinger-Bogen 14 |
> Fon: +49 (89) 32356-0
> Research & Development |       D-80807 Muenchen    |
> Fax: +49 (89) 32356-299
> "The security, stability and reliability of a
> computer system is reciprocally
>  proportional to the amount of vacuity between the
> ears of the admin"
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools


__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.