more problems
Markus Stumpf <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Organization | SpaceNet AG, Muenchen, Germany |
| Message-ID | <[email protected]> |
I have undertaken some of the rejected files a closer inspection today. I have two tar.gz file of a customer (can't make them available, contains proprietary information) sophie complains of being corrupted. Unpacking them neither "gunzip" nor "tar" complain. Repacking them from the directory tree yields an exactly same tar.gz file (MD5 hash). sophie still complains about a "corrupt file". Again, sweep does not complain (-f -sc -rec -cab -f -archive -loopback -tnef and an explicit -tar which should be included with -archive already). Same happens with some .doc files :( I can't test them because I don't have Windows, but sophie complains about a corrupt file, sweep doesn't Also, did you notice problems with sophs scanning Windows2003 files, e.g. .mdb files? Both, sophie and sweep complained about a .mdb file beeing corrupt, but there was no problem openining it with MS Access and even saving it to a different file and scanning it again didn't change a thing. What sophie savi settings are you using? I have attached mine to this email. Any comments are welcome. \Maex -- SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 "The security, stability and reliability of a computer system is reciprocally proportional to the amount of vacuity between the ears of the admin" _______________________________________________ vtools mailing list [email protected] http://www.vanja.com/list/listinfo.cgi/vtools
sophie.conf
(text/plain, 5.2 KB)
+-----------------------------------+------+-----+ | Configuration parameter | Type |Value| +-----------------------------------+------+-----+ | GrpSuper | 9 | 0 | | GrpArchiveUnpack | 9 | 1 | | GrpSelfExtract | 9 | 1 | | GrpExecutable | 9 | 1 | | GrpInternet | 9 | 1 | | GrpMSOffice | 9 | 1 | | GrpMisc | 9 | 1 | | GrpDisinfect | 9 | 0 | | GrpClean | 9 | 2 | | PEHandling | 3 | 1 | | Emulation | 3 | 1 | | PeEmulator | 3 | 1 | | DynamicDecompression | 3 | 1 | | Upx | 3 | 1 | | ExecFileDisinfection | 3 | 1 | | Ole2FileDisinfection | 3 | 1 | | Elf | 3 | 1 | | MachO | 3 | 1 | | SfxArchives | 3 | 1 | | ZipDecompression | 3 | 1 | | ZipUseChd | 3 | 1 | | ArjDecompression | 3 | 1 | | RarDecompression | 3 | 1 | | UueDecompression | 3 | 1 | | GZipDecompression | 3 | 1 | | CmzDecompression | 3 | 1 | | MSCabinet | 3 | 0 | | ISCabinet | 3 | 0 | | ISCabinetFull | 3 | 1 | | ITSS | 3 | 0 | | TarDecompression | 3 | 1 | | TnefAttachmentHandling | 3 | 1 | | TnefEmbedHandling | 3 | 0 | | Lha | 3 | 1 | | MSCompress | 3 | 1 | | ActiveMimeHandling | 3 | 1 | | Pdf | 3 | 1 | | HqxDecompression | 3 | 1 | | MbinDecompression | 3 | 1 | | AppleSingle | 3 | 1 | | Bzip2 | 3 | 0 | | Stuffit | 3 | 0 | | LoopBackEnabled | 3 | 1 | | OpenMacRf | 3 | 1 | | PalmPilotHandling | 3 | 1 | | Rtf | 3 | 1 | | Html | 3 | 1 | | OLE2Handling | 3 | 1 | | WordB | 3 | 1 | | VBA3Handling | 3 | 1 | | VBA5Handling | 3 | 1 | | DecompressVBA5 | 3 | 1 | | Vba5p | 3 | 0 | | ExcelFormulaHandling | 3 | 1 | | ProjectHandling | 3 | 1 | | ScrapObjectHandling | 3 | 1 | | VisioFileHandling | 3 | 1 | | OleDataMsoHandling | 3 | 1 | | OleScriptHandling | 3 | 1 | | OleRawHandling | 3 | 1 | | SrpStreamHandling | 3 | 1 | | Office2001Handling | 3 | 1 | | Vba5Dir | 3 | 0 | | PowerPointMacroHandling | 3 | 1 | | PowerPointEmbeddedHandling | 3 | 1 | | IgnoreTemplateBit | 3 | 1 | | OF95DecryptHandling | 3 | 1 | | DelVBA5Project | 3 | 1 | | HelpHandling | 3 | 1 | | Skip | 3 | 1 | | Mime | 3 | 1 | | Base64 | 3 | 1 | | Vbe | 3 | 1 | | OutlookExpress | 3 | 1 | | VbFiltering | 3 | 1 | | UTF16 | 3 | 1 | | Java | 3 | 1 | | Access | 3 | 1 | | CleanJpeg | 3 | 1 | | CleanBmp | 3 | 1 | | CleanGif | 3 | 1 | | CleanRiff | 3 | 1 | | CleanTiff | 3 | 1 | | CleanPng | 3 | 1 | | Xml | 3 | 0 | | FullMacroSweep | 3 | 0 | | FullPdf | 3 | 0 | | FullSweep | 3 | 0 | | StorageReport | 3 | 0 | | StorageReportAll | 3 | 0 | | StorageDetOnly | 3 | 0 | | DeleteAllMacros | 3 | 0 | | UnixArchive | 3 | 0 | | Rpm | 3 | 0 | | MaxRecursionDepth | 2 | 16 | | NamespaceSupport | 3 | 0 | | VirusDataDir | 10 | /usr/local/sav | VirusDataName | 10 | vdl | IdeDir | 10 | /usr/local/sav | AllowPartialVirusData | 3 | 0 | +-----------------------------------+------+-----+