SAVI options review for Sophos.
David Broome <[email protected]> Sat, 20 Mar 2004 01:57:16 -0800 (PST)
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Hello all, I ran the default SAVI settings from Sophie's config by Sophos. They suggest using the Grp settingd of GrpArchiveUnpack, GrpSelfExtract, and GrpInternet to 1. Do this concur with peoples experience for the best settings? If so I propose an update to the default sophie.savi. Dave, -- David Broome Senior_Programmer-Analyst.FineArts.UVic.CA /BSc 250.721-6307 [email protected] FIA 221 ---------- Forwarded message ---------- Date: Fri, 19 Mar 2004 12:39:15 -0500 From: [email protected] Reply-To: [email protected] To: [email protected] Subject: Re: SAVI options review for finearts.uvic.ca Hi David, I had to forward this to a SAVI developer. His comments are as follows: Firstly a bit of explanation - the first few lines "Grpxxxx" have '2' as the value because they are effectively "Set only" options. When you set a Grp option it actually just twiddles a set of other options. When you try and find out whether the Grp option is set, it doesn't attempt to read back all the options, it just returns an error result of "2". It looks to me like they have not set any of the Archive options. I would recommend they set "GrpArchiveUnpack" to "1". This will enable all the archive formats. They should also set "GrpSelfExtract" to "1". Finally, if they're using it for mail they should set "GrpInternet" to "1" - this enables MIME decoding and things like that. Hope this helps Mike To: [email protected] cc: bcc: From: David Broome <[email protected]> Date: 03/18/2004 10:24 PM Subject: SAVI options review for finearts.uvic.ca Hello, I use Sophos SAVI via Sophie. I would like you to review the SAVI options I have and comment on any configurations that would be an issue for a mail gateway and file scanner. NOTICE : Using Sophie configuration file '/etc/sophie.cfg' NOTICE : Setting configuration options - please wait... NOTICE : Configuration options set +-----------------------------------+------+-----+ | Configuration parameter | Type |Value| +-----------------------------------+------+-----+ | GrpSuper | 9 | 2 | | GrpArchiveUnpack | 9 | 2 | | GrpSelfExtract | 9 | 2 | | GrpExecutable | 9 | 2 | | GrpInternet | 9 | 2 | | GrpMSOffice | 9 | 2 | | GrpMisc | 9 | 2 | | GrpDisinfect | 9 | 2 | | GrpClean | 9 | 2 | | PEHandling | 3 | 1 | | Emulation | 3 | 1 | | PeEmulator | 3 | 1 | | DynamicDecompression | 3 | 1 | | Upx | 3 | 1 | | ExecFileDisinfection | 3 | 1 | | Ole2FileDisinfection | 3 | 1 | | Elf | 3 | 1 | | MachO | 3 | 1 | | SfxArchives | 3 | 0 | | ZipDecompression | 3 | 0 | | ZipUseChd | 3 | 1 | | ArjDecompression | 3 | 0 | | RarDecompression | 3 | 0 | | UueDecompression | 3 | 0 | | GZipDecompression | 3 | 0 | | CmzDecompression | 3 | 0 | | MSCabinet | 3 | 0 | | ISCabinet | 3 | 0 | | ISCabinetFull | 3 | 1 | | ITSS | 3 | 0 | | TarDecompression | 3 | 0 | | TnefAttachmentHandling | 3 | 0 | | TnefEmbedHandling | 3 | 0 | | Lha | 3 | 0 | | MSCompress | 3 | 0 | | ActiveMimeHandling | 3 | 1 | | Pdf | 3 | 1 | | HqxDecompression | 3 | 0 | | MbinDecompression | 3 | 0 | | AppleSingle | 3 | 1 | | Bzip2 | 3 | 0 | | Stuffit | 3 | 0 | | LoopBackEnabled | 3 | 0 | | OpenMacRf | 3 | 1 | | PalmPilotHandling | 3 | 1 | | Rtf | 3 | 1 | | Html | 3 | 1 | | OLE2Handling | 3 | 1 | | WordB | 3 | 1 | | VBA3Handling | 3 | 1 | | VBA5Handling | 3 | 1 | | DecompressVBA5 | 3 | 1 | | Vba5p | 3 | 0 | | ExcelFormulaHandling | 3 | 1 | | ProjectHandling | 3 | 1 | | ScrapObjectHandling | 3 | 1 | | VisioFileHandling | 3 | 1 | | OleDataMsoHandling | 3 | 1 | | OleScriptHandling | 3 | 1 | | OleRawHandling | 3 | 1 | | SrpStreamHandling | 3 | 1 | | Office2001Handling | 3 | 1 | | Vba5Dir | 3 | 0 | | PowerPointMacroHandling | 3 | 1 | | PowerPointEmbeddedHandling | 3 | 1 | | IgnoreTemplateBit | 3 | 1 | | OF95DecryptHandling | 3 | 1 | | DelVBA5Project | 3 | 1 | | HelpHandling | 3 | 1 | | Skip | 3 | 1 | | Mime | 3 | 0 | | Base64 | 3 | 0 | | Vbe | 3 | 1 | | OutlookExpress | 3 | 0 | | VbFiltering | 3 | 0 | | UTF16 | 3 | 1 | | Java | 3 | 1 | | Access | 3 | 1 | | CleanJpeg | 3 | 1 | | CleanBmp | 3 | 1 | | CleanGif | 3 | 1 | | CleanRiff | 3 | 1 | | CleanTiff | 3 | 1 | | CleanPng | 3 | 1 | | Xml | 3 | 0 | | FullMacroSweep | 3 | 0 | | FullPdf | 3 | 0 | | FullSweep | 3 | 0 | | StorageReport | 3 | 0 | | StorageReportAll | 3 | 0 | | StorageDetOnly | 3 | 0 | | DeleteAllMacros | 3 | 0 | | UnixArchive | 3 | 0 | | Rpm | 3 | 0 | | MaxRecursionDepth | 2 | 16 | | NamespaceSupport | 3 | 0 | | VirusDataDir | 10 | /usr/local/sweep/sav | VirusDataName | 10 | vdl | IdeDir | 10 | /usr/local/sweep/sav | AllowPartialVirusData | 3 | 0 | +-----------------------------------+------+-----+ NOTICE : pSAVI cleaned up and released/terminated Dave, -- David Broome Senior_Programmer-Analyst.FineArts.UVic.CA /BSc 250.721-6307 [email protected] FIA 221