Re: corrupted files reported by sophie & SAVI

On Fri, Jan 23, 2004 at 10:10:46PM +0100, Maciej Uhlig wrote:
> SAVI reported as 'corrupted' SOME files (not all) of the following
> "filetypes":
> 
> - ordinary text files
> - dot files (.bash_history, .mosaicpid)
> - Berkeley db files (*.db)
> - gzip archives (*.tar.gz) - especially MySQL archives, Sun patches
> - JIS files (from apache distro)
> 
> and more...

SAVI doesn't know about file type like you do. It has to look at the
file and make a guess as of what type the file should be treated.
If an ordinary text file by some heuristic is classified as being
a XYZ type and then it fails decoding it correctly it complains
about a corrupted file.

> Of course I have not to add: the majority of these files could be 
> succesfully visible under vi, could be decompressed by gzip, could
> be unpacked by tar and so on.

It would be very interesting to see what "sweep" has to report about
those files. If you have a list, why not feed the files to sweep?
This will also help to see if this is a problem with sophie+SAVI
or a problem with sophos in general.

> Just imagine people sending stuff in their mail (and they do it!).
> Then imagine how your sophie/SAVI duo works hard. And then imagine
> the "corrupted" files may contain a virus. And we have a tendency
> to pass the "corrupted" file to the user.

With the fix to correctly set the type for the Grp* options
and with setting "ZipUseChd: 1" and "limit_classif: 5000", nearly
all my problems with warning about corrupt files went away.

As to your fear about viruses and corrupt files:

5. Information from previous versions
-------------------------------------
January 2004 (3.77)
e) SAV Interface
   The order in which errors are processed has been fixed, so that if a file
   is both viral and corrupt (a very rare occurrence), SAVI returns the code
   SOPHOS_SAVI_ERROR_VIRUSPRESENT (and a valid results object) instead of
   SOPHOS_SAVI_ERROR_CORRUPT.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"