corrupted files reported by sophie & SAVI

"Maciej Uhlig" <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Well, I just wanted to see sophie/SAVI working in the large scale, so 
I modified some lines of code in order to get what follows:

- sophie doesn't stop after the first virus found
- sophie prints filename in case of SAVI error

I wanted to see what files SAVI treats as corrupted. I ordered sophie
to scan the whole filesystem(s) - several gigabytes of stuff.

I set GrpSuper to 1 - that's all. It was Sophos 3.77 release for
Solaris.

What I saw was fascinating.

SAVI reported as 'corrupted' SOME files (not all) of the following
"filetypes":

- ordinary text files
- dot files (.bash_history, .mosaicpid)
- Berkeley db files (*.db)
- gzip archives (*.tar.gz) - especially MySQL archives, Sun patches
- JIS files (from apache distro)

and more...

Of course I have not to add: the majority of these files could be 
succesfully visible under vi, could be decompressed by gzip, could
be unpacked by tar and so on.

I didn't investigate the problem in detail. I think there is a place
for several support cases.

This is a simple example only:

NOTICE           : Scanning file '/.../.mailboxlist'
WARNING          : Error: File corrupted, Sophie could not proceed.

# ls -l /.../.mailboxlist
-rw-r--r--   1  user   group          11 Jun  3  2002 /.../.mailboxlist
# cat /.../.mailboxlist
Trash
Sent
# 

Just imagine people sending stuff in their mail (and they do it!).
Then imagine how your sophie/SAVI duo works hard. And then imagine
the "corrupted" files may contain a virus. And we have a tendency
to pass the "corrupted" file to the user.

I came into conclusion we have to speak to Sophos and force them
to improve their product quality. I'm sure they know how to do it.

Maciek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.