corrupted files reported by sophie & SAVI
"Maciej Uhlig" <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Well, I just wanted to see sophie/SAVI working in the large scale, so I modified some lines of code in order to get what follows: - sophie doesn't stop after the first virus found - sophie prints filename in case of SAVI error I wanted to see what files SAVI treats as corrupted. I ordered sophie to scan the whole filesystem(s) - several gigabytes of stuff. I set GrpSuper to 1 - that's all. It was Sophos 3.77 release for Solaris. What I saw was fascinating. SAVI reported as 'corrupted' SOME files (not all) of the following "filetypes": - ordinary text files - dot files (.bash_history, .mosaicpid) - Berkeley db files (*.db) - gzip archives (*.tar.gz) - especially MySQL archives, Sun patches - JIS files (from apache distro) and more... Of course I have not to add: the majority of these files could be succesfully visible under vi, could be decompressed by gzip, could be unpacked by tar and so on. I didn't investigate the problem in detail. I think there is a place for several support cases. This is a simple example only: NOTICE : Scanning file '/.../.mailboxlist' WARNING : Error: File corrupted, Sophie could not proceed. # ls -l /.../.mailboxlist -rw-r--r-- 1 user group 11 Jun 3 2002 /.../.mailboxlist # cat /.../.mailboxlist Trash Sent # Just imagine people sending stuff in their mail (and they do it!). Then imagine how your sophie/SAVI duo works hard. And then imagine the "corrupted" files may contain a virus. And we have a tendency to pass the "corrupted" file to the user. I came into conclusion we have to speak to Sophos and force them to improve their product quality. I'm sure they know how to do it. Maciek