Re: sophie not getting bagle-h

On [03/02/04 13:58], CertaintyTech-Ed wrote:
> After looking at the sophie code it looks to me that sophie returns 0
> for password encrypted zip files and therefore the attachment doesn't
> get quarantined by my mail server.  I am not a C expert but it could be
> modified to return a different code for encrypted files.  Could anyone
> more experienced than I tackle this?
> 

I was looking at the code myself...
I think the best option would be to have a kind of strict mode for sophie.
Any error, other then resource issue, should be treated as fatal.  
THere is a ONLY_FATAL_ERRORS flag that is currently set and causes
sophie to return 0 (since encrypted file is not really a fatal error).
However, I think the flag should not be  a #define statement, but instead
a command line (or config) controlled parameter.

Also, we cannot return -1 in cases of encrypted files (-1 indicates temp
error).  We have to return 1 (virus) with appropriate description.


> ---
> Ed 
> 
> 
> 
> > -----Original Message-----
> > From: [email protected] 
> > [mailto:[email protected]] On Behalf Of CertaintyTech-Ed
> > Sent: Tuesday, March 02, 2004 12:08 PM
> > To: 'Discussion about Virge/Sophie/Trophie/...'
> > Subject: RE: [vtools] sophie not getting bagle-h
> > 
> > 
> > Does sophie generate a different exit code when encountering 
> > a password
> > protected file?  IF so couldn't one's mailserver be configured to
> > automatically quarantine these type of messages?
> > 
> > ---
> > Ed Henderson
> > 
> > 
> > > -----Original Message-----
> > > From: [email protected] 
> > > [mailto:[email protected]] On Behalf Of Yevgeniy Miretskiy
> > > Sent: Tuesday, March 02, 2004 10:18 AM
> > > To: Discussion about Virge/Sophie/Trophie/...
> > > Subject: Re: [vtools] sophie not getting bagle-h
> > > 
> > > 
> > > On [03/02/04 09:10], Trey Nolen wrote:
> > > > If it is password protected, and there is no way for sweep 
> > > to detect it, why
> > > > do they release an .ide file for it?
> > > 
> > > Because you can still detect it when you double click and try to 
> > > unzip the file :)
> > > 
> > > > 
> > > > Trey Nolen
> > > > 
> > > > ----- Original Message ----- 
> > > > From: "Yevgeniy Miretskiy" <[email protected]>
> > > > To: "Discussion about Virge/Sophie/Trophie/..." <[email protected]>
> > > > Sent: Tuesday, March 02, 2004 9:06 AM
> > > > Subject: Re: [vtools] sophie not getting bagle-h
> > > > 
> > > > 
> > > > > _______________________________________________
> > > > > vtools mailing list
> > > > > [email protected]
> > > > > http://www.vanja.com/list/listinfo.cgi/vtools
> > > > >
> > > > 
> > > > 
> > > > _______________________________________________
> > > > vtools mailing list
> > > > [email protected]
> > > > http://www.vanja.com/list/listinfo.cgi/vtools
> > > 
> > > -- 
> > >   Eugene Miretskiy <[email protected]>
> > >   INVISION.COM, INC.  (631) 543-1000
> > >   www.invision.net  /  www.longisland.com 
> > > 
> > 
> > _______________________________________________
> > vtools mailing list
> > [email protected]
> > http://www.vanja.com/list/listinfo.cgi/vtools
> > 
> 
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools

-- 
  Eugene Miretskiy <[email protected]>
  INVISION.COM, INC.  (631) 543-1000
  www.invision.net  /  www.longisland.com

_______________________________________________
vtools mailing list
[email protected]
http://www.vanja.com/list/listinfo.cgi/vtools

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)

iD8DBQFARNthbdWhgMNo07URAvo5AJ4xGRyd+u2ccTAnV+Gu5VQJZdB/1QCfZn2E
vL+IkF8mbpicbSH2R7xUyT8=
=HjEb
-----END PGP SIGNATURE-----