Re: Help for a newbie

Sergio Gonzalez <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hi Maex:

I'm using the sophie.savi sample file from etc directory fo the 
distribution. I found GrpArchiveUnpack was 2 on it. I followed your advice 
and set it to 1. The ZipUseChd was already set to 1 and ZipDecompression 
was 0. I changed to 1.

Unfortunately sophie can't see the virus yet. I tested CGPSophos executable 
file (CGPro plugin) to try to find the virus, and it actually finds the virus.


What other SAVI options do I have to turn on/off?. This is what I've in my 
sophie.savi file:

GrpExecutable: 2
GrpArchiveUnpack: 1
GrpSelfExtract: 2
GrpInternet: 2
GrpMSOffice: 2
GrpMisc: 2
GrpSuper: 2
GrpDisinfect: 2
GrpClean: 2
NamespaceSupport: 0
FullSweep: 0
DynamicDecompression: 1
FullMacroSweep: 0
OLE2Handling: 1
IgnoreTemplateBit: 1
VBA3Handling: 1
VBA5Handling: 1
OF95DecryptHandling: 1
HelpHandling: 1
DecompressVBA5: 1
Emulation: 1
PEHandling: 1
ExcelFormulaHandling: 1
PowerPointMacroHandling: 1
PowerPointEmbeddedHandling: 1
ProjectHandling: 1
ZipDecompression: 1
ArjDecompression: 1
RarDecompression: 1
UueDecompression: 1
GZipDecompression: 1
TarDecompression: 1
CmzDecompression: 1
HqxDecompression: 1
MbinDecompression: 1
LoopBackEnabled: 1
MaxRecursionDepth: 16
Lha: 1
SfxArchives: 1
TnefAttachmentHandling: 1
MSCompress: 1
MSCabinet: 1
DeleteAllMacros: 1
Vbe: 1
ExecFileDisinfection: 1
VisioFileHandling: 1
Mime: 1
ActiveMimeHandling: 1
DelVBA5Project: 1
ScrapObjectHandling: 1
SrpStreamHandling: 1
Office2001Handling: 1
Upx: 1
PalmPilotHandling: 1
Pdf: 1
Rtf: 1
Html: 1
Elf: 1
WordB: 1
OutlookExpress: 0
Java: 1
Access: 1
AppleSingle: 1
VbFiltering: 1
Ole2FileDisinfection: 1
MachO: 1
ZipUseChd: 1
ISCabinet: 1
ISCabinetFull: 1
ITSS: 1
TnefEmbedHandling: 1
Bzip2: 1
Stuffit: 1
OpenMacRf: 1
Vba5p: 1
OleDataMsoHandling: 1
OleScriptHandling: 1
OleRawHandling: 1
Vba5Dir: 1
Skip: 1
Base64: 1
UTF16: 1
CleanJpeg: 1
CleanBmp: 1
CleanGif: 1
CleanRiff: 1
CleanTiff: 1
CleanPng: 1
Xml: 1
FullPdf: 1
UnixArchive: 1
Rpm: 1
#VirusDataDir:
#VirusDataName:
#IdeDir:





Sergio Gonzalez
[email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.