Re: sophie not detecting some viruses

On Mon, Jan 19, 2004 at 08:01:32PM +0100, Vanja Hrustic wrote:
> The file which you've put online - how did it "get" into unpacked shape?
> 
> Basically, what I'm wondering is if this arrived in an email (and had
> proper MIME headers, etc.), or it was a webpage downloaded from somewhere,
> or ... ?

Yes ist was an email. The file as put on the webserver - was part of a
"photos.zip", an encrypted ZIP file with the password in the email:
------------------------------------------------------------------------
Subject: My Photo
Date: Sun, 18 Jan 2004 09:23:14 -0800
From: Katie <[email protected]>
To: <[email protected]>

hi,
just as i promised, i'm sending you my photo.

ps: password is 123, so noone else would look ;)
------------------------------------------------------------------------
The attachment was the "photo.zip".
The ZIP file contained an image (JPG) and the "Profile-720974.html".
I have put the photo.zip on
    http://www.space.net/~maex/photo.zip
Sorry, should have done that initially.
I was curious about the content, as it looked rather suspicious and
used the sweep utility for a quick check and it noticed the virus.

I made a "mistake" and sent the .html file only on to a colleague with a
note. The "mistake" was that it shouldn't have passed the scanner and
generate an error, if sent from that host.
I was rather astonished it didn't :/

> Either it is a combination of config options that simply don't match
> (maybe something has to be turned off in Sophie config in order to detect
> this one), or Sweep uses something I am not aware of.

Thanks.
I'll send the file to Sophos and see if I can get some additional
information.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"