RE: corrupted files reported by sophie & SAVI

Markus:

> SAVI doesn't know about file type like you do. It has to look at the
> file and make a guess as of what type the file should be treated.
> If an ordinary text file by some heuristic is classified as being
> a XYZ type and then it fails decoding it correctly it complains
> about a corrupted file.

basically you're right, but... GNU file reports in case of the file from my
previous mail:

# /usr/local/bin/file /.../.mailboxlist
/.../.mailboxlist: ASCII text

what heuristic does Sophos apply to find 11-byte ASCII text file needs
decoding and
report it as 'corrupted'???

is it impossible for them to incorporate GNU utilities (file, tar, etc.) in
their product?
or it's a licence question maybe? in this case they should develop their own
reliable
tools....

> It would be very interesting to see what "sweep" has to report about
> those files. If you have a list, why not feed the files to sweep?
> This will also help to see if this is a problem with sophie+SAVI
> or a problem with sophos in general.

these files are reported by sweep as virus free. you see, sweep is a black
box.
it gets from SAVI: 'file corrupted' but it puts to the user 'no viruses were
discovered', I suppose.
which is true.... but sophie is more precise...

> With the fix to correctly set the type for the Grp* options
> and with setting "ZipUseChd: 1" and "limit_classif: 5000", nearly
> all my problems with warning about corrupt files went away.

so I second a request from Ed: please let us see your /etc/sophie.savi.

are you sure the file is being unpacked/decoded at all when ZipUseChd option
is set :-)?
maybe it is skipped? we don't know what this undocumented option does in
fact. we only
know it supressess the number of reports about corrupted files.

>    The order in which errors are processed has been fixed,

thanks, this is good. it is at least a sign users have some influence on
Sophos work...

Maciek