Re: sophie not detecting some viruses

On Monday 19 January 2004 10:21 pm, Vanja Hrustic wrote:
> On Mon, 19 Jan 2004 17:10:49 -0500
>
> Jerrin Kallukalam <[email protected]> wrote:
> > hello,
> >  I  recompiled sophie after adding code to set  SAVI engine settings to
> > default, and then sophie can detect  'Troj/Sefex-A'.   I added these
> > lines to the end of the function  "void sophie_set_engine_config(CISavi3
> >
> > *pSAVI)".
> >
> >  hr = pSAVI->pVtbl->SetConfigDefaults(pSAVI);
> >         if (SOPHOS_FAILED(hr))
> >                 sophie_print(0, "%s Failed to SetConfigDefaults()",
> > WARNSTR);
> >         else
> >                 sophie_print(1, "%s Default SAVI configuration options
> > set", NOTESTR);
> >
> > So the problem might be somewhere in the SAVI engine configuration
> > settings. Some config value would have to be unset.
> > Jerrin.
>
> Now that you tried it, it looks so obvious :)
>
> It is enough to remove/rename /etc/sophie.savi file in order for Sophie to
> use Sophos defaults (forgot that I've added that 'fallback' long time
> ago). Detects the virus now.
>
> "sophie -c" will list the default options, but guessing the combinations
> of options (to see which one screws up) will take some time.
>
> Vanja
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools

Clue?

gamma# sweep -ss -mime Profile-720974.html.bin
gamma# sweep -ss Profile-720974.html.bin
>>> Virus 'Troj/Sefex-A' found in file Profile-720974.html.bin

gamma# sweep -V|head
SWEEP virus detection utility
Copyright (c) 1989,2003 Sophos Plc, www.sophos.com

System time 23:06:56, System date 19 January 2004

Product version           : 3.75A
Engine version            : 2.17
User interface version    : 2.07.031
Platform                  : FreeBSD/Intel
Released                  : 03 November 2003

-- 
ian j hart

http://ars.userfriendly.org/cartoons/?id=20031016