Re: encrypted zips / sophie

Hi all,

         One of our huge mailing lists (7,000+ users) got nailed by the 
Bagle-H worm
tonight. It went right through my sophos/sophie set up (running linux9, 
exim, sophos
3.79 and sophie 3.04rc2). As was mentioned in this thread, sophos does 
not detect
viruses that are inside a password-encrypted file. I ran it with the 
-archive option
on a known-infected file and it found nothing. I then recompiled sophie, 
updating the
sophie_core.c file as recommended by Chris & CertaintyTech-Ed, and then 
ran sophie
on the infected mailbox, and again it detected nothing (I know it's 
infected because we also
run Trend on our desktops and its detecting this thing all over the 
place). I was hoping
to clean out everyone's mailboxes overnight before they arrived in the 
morning, but I
can't seem to figure out a way to hunt-and-destroy these things. Any 
ideas why the
code below didn't find anything?  TIA - jim -



CertaintyTech-Ed wrote:

> You also need to add the line:
>
>      sophie_log_virus(scan_file, scan_results);
>
> So that sophie returns a virus description as well as a the status 
> code or sophie dies (at least it does in my setup since I access 
> sophie thru a UNIX socket).  Here is what I am currently using:
>
>                 case SOPHOS_SAVI_ERROR_FILE_ENCRYPTED:
>                 sophie_print(0, "%s %s", WARNSTR, 
> SOPHIE_SAVI_ERROR_FILE_ENCRYPTED);
>                 strncpy(ret_error_string, 
> SOPHIE_SAVI_ERROR_FILE_ENCRYPTED, sizeof(ret_error_string)-1);
>                 sophie_log_virus(scan_file, scan_results);
>
> #ifdef ONLY_FATAL_ERRORS
>                 retval = 0;
> #else
>                 retval = 1;
> #endif
>                 break;
>