RE: encrypted zips / sophie

> Hi all,
> 
>          One of our huge mailing lists (7,000+ users) got 
> nailed by the 
> Bagle-H worm
> tonight. It went right through my sophos/sophie set up 
> (running linux9, 
> exim, sophos
> 3.79 and sophie 3.04rc2). As was mentioned in this thread, 
> sophos does 
> not detect
> viruses that are inside a password-encrypted file. I ran it with the 
> -archive option
> on a known-infected file and it found nothing. I then 
> recompiled sophie, 
> updating the
> sophie_core.c file as recommended by Chris & 
> CertaintyTech-Ed, and then 
> ran sophie
> on the infected mailbox, and again it detected nothing (I know it's 
> infected because we also
> run Trend on our desktops and its detecting this thing all over the 
> place). I was hoping
> to clean out everyone's mailboxes overnight before they 
> arrived in the 
> morning, but I
> can't seem to figure out a way to hunt-and-destroy these things. Any 
> ideas why the
> code below didn't find anything?  TIA - jim -
> 
> 

Perhaps its your sophie.savi file.  The Sophos Bagle-Zip ide should be
picking up the Bagle-H.  It has on my system. Look for "Mime = 1".

---
Ed Henderson, Managing Partner
Certainty Tech
http://www.certainty.net/