Re: sophie not detecting some viruses

hello,
 I  recompiled sophie after adding code to set  SAVI engine settings to 
default, and then sophie can detect  'Troj/Sefex-A'.   I added these 
lines to the end of the function  "void sophie_set_engine_config(CISavi3 
*pSAVI)".

 hr = pSAVI->pVtbl->SetConfigDefaults(pSAVI);
        if (SOPHOS_FAILED(hr))
                sophie_print(0, "%s Failed to SetConfigDefaults()", 
WARNSTR);
        else
                sophie_print(1, "%s Default SAVI configuration options 
set", NOTESTR);

So the problem might be somewhere in the SAVI engine configuration 
settings. Some config value would have to be unset.
Jerrin.

This is the log.

NOTICE           : Sophie configuration file not specified - falling 
back to defaults
NOTICE           : Using Sophie configuration file '/etc/sophie.cfg'
NOTICE           : Setting configuration options - please wait...
NOTICE           : Configuration options set
NOTICE           : Options are set to defaults
Sophos engine    : Sophos engine version 2.17
Sophie IDE       : Sophos IDE version 3.77X (detects 86847 viruses)
SAVI config      : /etc/sophie.savi
Max processes    : 20
Socket path      : /var/run/sophie/sophie
Umask            : 7
PID file         : /var/run/sophie/sophie.pid
Timeout          : 300 seconds
Running as user  : vscan
Socket group     : vscan
Logname          : sophie
Log facility     : 16 (mail)
Log priority     : 5 (notice)
Error strings?   : yes
Timestamps?      : no
Show virus name? : yes
Callbacks?       : yes
limit_classif    : 10
limit_nextfile   : 10000
limit_decompr    : 1000
socket_check     : yes
Sophie version   : 3.03
NOTICE           : Scanning file 'Profile-720974.html.bin'
WARNING          : Scan result => 'Profile-720974.html.bin' infected 
with virus 'Troj/Sefex-A'
NOTICE           : pSAVI cleaned up and released/terminated
NOTICE           : SAVI cleaned up and terminated

Vanja Hrustic wrote:

>On Mon, 19 Jan 2004 14:30:14 -0500
>"CertaintyTech" <[email protected]> wrote:
>
>  
>
>>When I vi the file it starts with:
>>
>>MIME-Version: 1.0^M
>>Content-Location:file:///profile.exe^M
>>Content-Transfer-Encoding: base64^M
>>
>>
>>That looks like MIME stuff to me...I haven't tried it but if you extract
>>profile.exe from the file using ripmime I bet sophie would then detect
>>the virus.
>>    
>>
>
>Actually, it is not detected (by Sweep) when unpacked. That's why I was
>looking at what triggers detection in Sweep.
>
>What bothers me is that Sweep/Sophie and Vscan/Trophie didn't pick it up
>as a virus (when it's unpacked, as exe).
>
>McAfee uvscan did recognize it (as MIME, and unpacked), though.
>
>Oh well - I think this is bit out of my reach, to say so. If anyone can
>figure out if this is Sophie bug, I'll fix it asap. However, I can't seem
>to figure out how to make Sophie detect it, at this point of time.
>
>Vanja
>_______________________________________________
>vtools mailing list
>[email protected]
>http://www.vanja.com/list/listinfo.cgi/vtools
>
>  
>