Re: sophie not detecting some viruses

For what it's worth, one of our folks with a PC scanned the file
using Norton Anti-Virus and it was identified as Sefex.

  http://www.space.net/~maex/Profile-720974.html.bin


I'm going to open a call with Sophos Support to see what they
have to say about what options are required to be enabled for
the SAVI libraries to identifiy the virus in the file.

Has anyone had any feedback from Sophos?

- Bill


   William B. Earle	Computing & Information Technology
			University at Buffalo
Voice: 716.645.6580	301 Computing Center
Fax:   716.645.5972	Buffalo, NY 14260


On Mon, 19 Jan 2004, Vanja Hrustic wrote:

> On Mon, 19 Jan 2004 14:30:14 -0500
> "CertaintyTech" <[email protected]> wrote:
>
> > When I vi the file it starts with:
> >
> > MIME-Version: 1.0^M
> > Content-Location:file:///profile.exe^M
> > Content-Transfer-Encoding: base64^M
> >
> >
> > That looks like MIME stuff to me...I haven't tried it but if you extract
> > profile.exe from the file using ripmime I bet sophie would then detect
> > the virus.
>
> Actually, it is not detected (by Sweep) when unpacked. That's why I was
> looking at what triggers detection in Sweep.
>
> What bothers me is that Sweep/Sophie and Vscan/Trophie didn't pick it up
> as a virus (when it's unpacked, as exe).
>
> McAfee uvscan did recognize it (as MIME, and unpacked), though.
>
> Oh well - I think this is bit out of my reach, to say so. If anyone can
> figure out if this is Sophie bug, I'll fix it asap. However, I can't seem
> to figure out how to make Sophie detect it, at this point of time.
>
> Vanja
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>