RE: sophie not detecting some viruses

When I vi the file it starts with:

MIME-Version: 1.0^M
Content-Location:file:///profile.exe^M
Content-Transfer-Encoding: base64^M


That looks like MIME stuff to me...I haven't tried it but if you extract
profile.exe from the file using ripmime I bet sophie would then detect
the virus.

---
Ed Henderson
Certainty Tech
814-425-3555 or 800-747-0681
http://www.certainty.net/



> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Markus Stumpf
> Sent: Monday, January 19, 2004 1:45 PM
> To: Discussion about Virge/Sophie/Trophie/...
> Subject: Re: [vtools] sophie not detecting some viruses
> 
> 
> On Mon, Jan 19, 2004 at 01:05:11PM -0500, CertaintyTech wrote:
> > Sophie does not pickup this virus on my system either when 
> scanning the
> > raw message.  From my experience sophie can't be trusted to scan raw
> > MIME messages.  But that's why my virus scanner, 
> qmail-scanner, always
> > unpacks MIME attachments first then scans the attachment file using
> > sophie. 
> 
> If you look at the file with e.g. "less" you will notice that it /is/
> already unpacked. It does not consist of MIME parts any more.
> 
> 	\Maex
> 
> -- 
> SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 
> (89) 32356-0
> Research & Development |       D-80807 Muenchen    | Fax: +49 
> (89) 32356-299
> "The security, stability and reliability of a computer system 
> is reciprocally
>  proportional to the amount of vacuity between the ears of the admin"
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>