Re: encrypted zips / sophie

The default sopie.savi file has most tests turned off.


Have you activated all the Grp options: in /etc/sophie.savi.

# Executable files
GrpExecutable: 1

# All archive and compressed archive file formats (e.g. ZIP, UUE, etc)
GrpArchiveUnpack: 1

# File formats that contain an executable stub that automatically
decompresses
# the body of the file
GrpSelfExtract: 1

# File formats commonly in use on the internet
GrpInternet: 1

# Microsoft Office file formats
GrpMSOffice: 1

# File formats that do not fall into any of the above categories
GrpMisc: 1


I went a little paranoid and turned many of the individual test on as
well:

NamespaceSupport: 3
FullSweep: 1
ZipDecompression: 1
ArjDecompression: 1
RarDecompression: 1
UueDecompression: 1
GZipDecompression: 1
TarDecompression: 1
CmzDecompression: 1
HqxDecompression: 1
MbinDecompression: 1
SfxArchives: 1
TnefAttachmentHandling: 1
MSCompress: 1
MSCabinet: 1
Mime: 1
ISCabinet: 1
Base64: 1

FYI - This is a description of the SAVI group functions from SOPHOS.

" There are various types of configuration option. Most of the options
that change what the engine actually does are effectively on/off options.
You set them to "0" to turn them off, or "1" to turn them on. The SAVI API
provides a way of setting the value of an option and also provides a way
of reading the value back to find out what options are currently set.

The Group options are a convenient way of setting a whole bunch of similar
options to the same value in one go. If you tell SAVI to set
"GrpArchiveUnpack" to "1" it will turn on all archive-related options.
This makes it much easier to enable whole types of feature within the
engine - without the "Grp" option you would need to turn each archive type
on or off individually.

It also makes it easy to do things like turning on all options of a
particular class with one or two exceptions. For example, if you wanted to
enable all archive types except bzip2, you would set "GrpArchiveUnpack" to
"1" and then set "Bzip2" to "0". This leads into the reason for the "2"
value.

Internally the "Grp" options are not individual options, but are a way of
setting a whole group of individual options. To read back the value of a
group option is easy if all the options are set to the same value, but if
one or more of the options in a group has been set to 'on' when the others
are 'off' this becomes hard. If 8 of the 12 options are on and 4 are off,
should we say the group is on or off? We answered this question the simple
way by saying that if you try to query the current setting of a group
option, SAVI will always return an 'INVALID' response of 2. If you want to
find our which options are set, you need to look at the individual options
not at the group options. If you try to configure the Group option with a
value of 2 it will do nothing.

A major benefit of Group options is that they also provide a way of
'future-proofing' an application against new features that we might add.
For example, "GrpArchiveUnpack" will set all the current archive-unpacking
options. If you write an application now to use "GrpArchiveUnpack" it will
also be able to turn on or off any new types of archive handling that we
add to the engine in the future without having to add code that handles
that option specifically.
"

Dave,
--
David Broome   Senior_Programmer-Analyst.FineArts.UVic.CA  /BSc
250.721-6307   [email protected]                    FIA 221

On Tue, 6 Apr 2004, Jim Savoy wrote:

>
> Hi all,
>
>          One of our huge mailing lists (7,000+ users) got nailed by the
> Bagle-H worm
> tonight. It went right through my sophos/sophie set up (running linux9,
> exim, sophos
> 3.79 and sophie 3.04rc2). As was mentioned in this thread, sophos does
> not detect
> viruses that are inside a password-encrypted file. I ran it with the
> -archive option
> on a known-infected file and it found nothing. I then recompiled sophie,
> updating the
> sophie_core.c file as recommended by Chris & CertaintyTech-Ed, and then
> ran sophie
> on the infected mailbox, and again it detected nothing (I know it's
> infected because we also
> run Trend on our desktops and its detecting this thing all over the
> place). I was hoping
> to clean out everyone's mailboxes overnight before they arrived in the
> morning, but I
> can't seem to figure out a way to hunt-and-destroy these things. Any
> ideas why the
> code below didn't find anything?  TIA - jim -
>
>
>
> CertaintyTech-Ed wrote:
>
> > You also need to add the line:
> >
> >      sophie_log_virus(scan_file, scan_results);
> >
> > So that sophie returns a virus description as well as a the status
> > code or sophie dies (at least it does in my setup since I access
> > sophie thru a UNIX socket).  Here is what I am currently using:
> >
> >                 case SOPHOS_SAVI_ERROR_FILE_ENCRYPTED:
> >                 sophie_print(0, "%s %s", WARNSTR,
> > SOPHIE_SAVI_ERROR_FILE_ENCRYPTED);
> >                 strncpy(ret_error_string,
> > SOPHIE_SAVI_ERROR_FILE_ENCRYPTED, sizeof(ret_error_string)-1);
> >                 sophie_log_virus(scan_file, scan_results);
> >
> > #ifdef ONLY_FATAL_ERRORS
> >                 retval = 0;
> > #else
> >                 retval = 1;
> > #endif
> >                 break;
> >
>
>
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>