Re: encrypted zips / sophie

"Trey Nolen" <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Message
>Now in qmail-scanner (which I use to call sophie) it will detect the virus
as "Error: File was encrypted".  Not pretty but it works...


But what will it do with it at that point? Will it quarantine it?

Trey Nolen



> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of Chris Edwards
> Sent: Wednesday, March 03, 2004 7:43 AM
> To: [email protected]; [email protected]
> Cc: Alan Thew; Kenneth Stevenson
> Subject: [vtools] encrypted zips / sophie
>
>
> Hi,
>
> If anyone's interested, its easy to make sophie block encrypted zips.
>
> In sophie_core.c find the "case
> SOPHOS_SAVI_ERROR_FILE_ENCRYPTED:" and set
> the return value to 1.
>
>
>   case SOPHOS_SAVI_ERROR_FILE_ENCRYPTED:
>   sophie_print(0, "%s %s", WARNSTR, SOPHIE_SAVI_ERROR_FILE_ENCRYPTED);
>   strncpy(ret_error_string, SOPHIE_SAVI_ERROR_FILE_ENCRYPTED,
>  sizeof(ret_error_string)-1);
>   #ifdef ONLY_FATAL_ERRORS
>               retval = 1;
>   #else
>               retval = 1;
>   #endif
>
>
> Hope this is (some) use.
>
> I guess it would nice to have this as a run-time config
> option ( Hi Vanja! )
>
> Chris
>
> --
> Chris Edwards, Glasgow University Computing Service
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>



_______________________________________________
vtools mailing list
[email protected]
http://www.vanja.com/list/listinfo.cgi/vtools
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.