RE: encrypted zips / sophie

Are you trying to scan the native files in the maildirs?

In my experience, SAV can't do this (it doesn't know how to scan
MIME-encoded files).

I wrote a script that uses Sophie/SAV to accomplish this task, however:  it
recurses the specified path, and for each file it munpacks to a temporary
directory, scans the resulting files with SAV via Sophie (and here the virus
IS detected once the files are munpacked).  If a virus is found, it moves
the original infected file to a specified quarantine folder.  It then cleans
up the temporary directory.

I would be happy to send you the script if this is what you are trying to
do.

David Rueter
[email protected]

-----Original Message-----
From: [email protected] [mailto:[email protected]]On
Behalf Of David Broome
Sent: Tuesday, April 06, 2004 5:01 PM
To: [email protected]; Discussion about Virge/Sophie/Trophie/...
Subject: Re: [vtools] encrypted zips / sophie


Interesting ...

Do have the "W32/Bagle-Zip" ide file and current sophos?

- just thinking of the basics. ;-)

I'm rejecting hundreds a day.

Dave,
--
David Broome   Senior_Programmer-Analyst.FineArts.UVic.CA  /BSc
250.721-6307   [email protected]                    FIA 221

On Tue, 6 Apr 2004, Jim Savoy wrote:

>
> Hi people,
>
>            Still struggling with this. I changed all of the Grp flags in
> sophie.savi
> from '2' to '1' and changed Mime from '0' to '1'. I also added Ed's code
> to sophie_core.c and recompiled.
>
> But when I run this:
>
>  # ./sophie -f /tmp/virus.txt   (where virus.txt contains the Bagle-H
worm)
>
> the results are (here's the tail end of them):
>
> Sophie version   : 3.04rc2
> NOTICE           : Scanning file '/tmp/virus.txt'
> NOTICE           : pSAVI cleaned up and released/terminated
> NOTICE           : SAVI cleaned up and terminated
>
>
> Shouldn't this display that it found the Bagle-H or Bagle-Zip?
> As I mentioned this morning, I have thousands of infected mailboxes
> and wish to clean them all out tonight using sophie. But the results of
> this test seem to indicate it is still not detecting anything. Any ideas?
> Thanks!
>
>  - jim -
>
>
>
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>
_______________________________________________
vtools mailing list
[email protected]
http://www.vanja.com/list/listinfo.cgi/vtools