Re: Re: Problem solved, bug in sophie found

On Mon, Jan 26, 2004 at 02:53:21PM +0100, L. Jankok wrote:
> Ok.. If I change my sophie.savi a bit as suggested then it will
> not detect the following virus : 
> 
> NOTICE           : Scanning file '/home/xinu/Mime.822' 
> WARNING          : Scan result => '/home/xinu/Mime.822' infected with virus 'W32/Dumaru-Y'
> 
> Only with mime enabled it will detect Dumaru-Y but then it will not detect Sefex-A.

Sefex-A is a "general dropper". The ZIP file which initiated all the
discussion is now scanned without problems using my 1-line modification,
SAVI 3.78 and the sophie.savi I have posted earlier.

HOWEVER: It does not detect Sefex-A but a Troj/Tofger-H (I got the IDE
from Sophos per email). I don't know why, but it looks like it was not
incorporated in the additional IDE.zip for 3.78

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"