Re: more problems

On Tue, Jan 20, 2004 at 02:15:24PM +0100, Markus Stumpf wrote:
> What sophie savi settings are you using?
> I have attached mine to this email. Any comments are welcome.

I have played around a bit more.
>From my understanding
   GrpArchiveUnpack: 1
should be a shortcut for
   ZipDecompression: 1
   ArjDecompression: 1
   TarDecompression: 1
   [ ... ]
just like the "-archive" option to sweep is shotcut for -zip -gzip -arj -cmz
-tar -rar. Correct?

I have created a tar file containing a W32/Bagle-A.

  GrpArchiveUnpack: 1
  TarDecompression: 1
    sophie -d -f bla.tar
    Scan result => 'bla.tar' infected with virus 'W32/Bagle-A'

  GrpArchiveUnpack: 1
  TarDecompression: 0
    sophie -d -f bla.tar
    Scan result => 'bla.tar' infected with virus 'W32/Bagle-A'

  GrpArchiveUnpack: 0
  TarDecompression: 1
    sophie -d -f bla.tar
    => NO VIRUS

So it looks like the Group definition overrides the component settings.
However according to the SAVI document this is misbehaviour, as they say
one should frst set the Group Options which can be overriden by more
specific options and according to their list TarDecompression belongs to
group GrpArchiveUnpack.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"