RE: sophie not detecting some viruses
Renato <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
sorry. you are right. I guess I'm so frustrated with every libsavi behaving differently and sometimes scanning or not some files, that I'm jumping to conclusion too fast. --- Maciej Uhlig <[email protected]> wrote: > it's still unclear to me. > > SOPHOS_TYPE_U16 is unsigned short int and should > accomodate 0..65535. > > I enabled some printing in sophie_init.c and got > even something like that: > > NOTICE : Option 'GrpArchiveUnpack' set to > '3' > > so SOPHOS_FAILED(hr) was false, i.e. SAVI didn't > fail and accepted '3' as > option value. > > but still, sophie -c reports value of 1 . > > more explanation? > > Maciek > > > -----Original Message----- > > From: [email protected] > > [mailto:[email protected]]On Behalf Of > Renato > > Sent: Wednesday, January 21, 2004 11:30 PM > > To: Discussion about Virge/Sophie/Trophie/... > > Subject: RE: [vtools] sophie not detecting some > viruses > > > > > > It looks like every parameter of SAVIlib is either > > SOPHOS_TYPE_U16 or SOPHOS_TYPE_U32 type. If you > take a > > look at sophie_init.c, you will see that the only > one > > that is SOPHOS_TYPE_U32, is "MaxRecursionDepth". > > > > I did an experiment and tried to pass '2' to > > GrpArchiveUnpack using SOPHOS_TYPE_U32 type ( > > hardcoded ). Sophie complained about this > parameter > > and didn't let me do this, using, therefore the > > default value, which is 2... then I concluded that > '2' > > should be equal to '0', since the only two > possible > > values you could set programatically is either 0 > or > > 1... ( I don't understand how '2' could be a > default > > if it doesn't accept SOPHOS_TYPE_U32... ) > > > > I hope I could make myself clear... > > > > --- Maciej Uhlig <[email protected]> wrote: > > > Vanja: > > > > > > > Now that you tried it, it looks so obvious :) > > > > > > > > It is enough to remove/rename /etc/sophie.savi > > > file in order for Sophie to > > > > use Sophos defaults (forgot that I've added > that > > > 'fallback' long time > > > > ago). Detects the virus now. > > > > > > > > "sophie -c" will list the default options, but > > > guessing the combinations > > > > of options (to see which one screws up) will > take > > > some time. > > > > > > do you happen to know the meaning of all > possible > > > option values for Sophos > > > options? > > > > > > this question is based on the fact Markus in his > > > mail "more problems" used 0 > > > and 1 only, > > > while Sophos default seems to be 2 (at least for > > > group options), for > > > instance: > > > > > > | GrpArchiveUnpack | 9 | 2 > | > > > > > > is 0 equal to 2, as Renato suggested, or more, 3 > is > > > possible too (pure > > > speculation :-)) > > > > > > is anybody able to clarify this? > > _______________________________________________ > vtools mailing list > [email protected] > http://www.vanja.com/list/listinfo.cgi/vtools __________________________________ Do you Yahoo!? Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes http://hotjobs.sweepstakes.yahoo.com/signingbonus