RE: sophie not getting bagle-h

"CertaintyTech-Ed" <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <00a401c40088$539fcb70$9200a8c0@ED01>
After looking at the sophie code it looks to me that sophie returns 0
for password encrypted zip files and therefore the attachment doesn't
get quarantined by my mail server.  I am not a C expert but it could be
modified to return a different code for encrypted files.  Could anyone
more experienced than I tackle this?

---
Ed 



> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of CertaintyTech-Ed
> Sent: Tuesday, March 02, 2004 12:08 PM
> To: 'Discussion about Virge/Sophie/Trophie/...'
> Subject: RE: [vtools] sophie not getting bagle-h
> 
> 
> Does sophie generate a different exit code when encountering 
> a password
> protected file?  IF so couldn't one's mailserver be configured to
> automatically quarantine these type of messages?
> 
> ---
> Ed Henderson
> 
> 
> > -----Original Message-----
> > From: [email protected] 
> > [mailto:[email protected]] On Behalf Of Yevgeniy Miretskiy
> > Sent: Tuesday, March 02, 2004 10:18 AM
> > To: Discussion about Virge/Sophie/Trophie/...
> > Subject: Re: [vtools] sophie not getting bagle-h
> > 
> > 
> > On [03/02/04 09:10], Trey Nolen wrote:
> > > If it is password protected, and there is no way for sweep 
> > to detect it, why
> > > do they release an .ide file for it?
> > 
> > Because you can still detect it when you double click and try to 
> > unzip the file :)
> > 
> > > 
> > > Trey Nolen
> > > 
> > > ----- Original Message ----- 
> > > From: "Yevgeniy Miretskiy" <[email protected]>
> > > To: "Discussion about Virge/Sophie/Trophie/..." <[email protected]>
> > > Sent: Tuesday, March 02, 2004 9:06 AM
> > > Subject: Re: [vtools] sophie not getting bagle-h
> > > 
> > > 
> > > > _______________________________________________
> > > > vtools mailing list
> > > > [email protected]
> > > > http://www.vanja.com/list/listinfo.cgi/vtools
> > > >
> > > 
> > > 
> > > _______________________________________________
> > > vtools mailing list
> > > [email protected]
> > > http://www.vanja.com/list/listinfo.cgi/vtools
> > 
> > -- 
> >   Eugene Miretskiy <[email protected]>
> >   INVISION.COM, INC.  (631) 543-1000
> >   www.invision.net  /  www.longisland.com 
> > 
> 
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.