Re: Problem solved, bug in sophie found
Markus Stumpf <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Organization | SpaceNet AG, Muenchen, Germany |
| Message-ID | <[email protected]> |
On Thu, Jan 22, 2004 at 06:36:22AM -0800, Renato wrote:
> I recompile Sophie with this new setting, but using
> 3.76 and 3.77b on Linux I still can't scan for
> Troj/Sefex-A. I guess there are some bugs in libsavi
> as well.
In order to scan for Troj/Sefex-A it is essential to have
Mime: 0
This is also according to a support answer from Sophos.
Als the Mime option belongs to the GrpInternet and you want to have
GrpInternet: 1
it is essential that you explicitely set Mime to 0, later.
It is also important that all the Grp* options are set prior to any
other option, so keep those at the top of your sophie.savi file.
"Mime enables decoding and scanning inside a MIME encoded message block".
IMHO the broken MIME mimic of Troj/Sefex-A causes the SAVI to
incorrectly handle the file that's why you can detect the virus with
sweep -mime either.
\Maex
--
SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
proportional to the amount of vacuity between the ears of the admin"