RE: encrypted zips / sophie

Yes please! ;-)

Greets,
Peter

> -----Oorspronkelijk bericht-----
> Van: [email protected] 
> [mailto:[email protected]] Namens David Rueter
> Verzonden: woensdag 7 april 2004 2:12
> Aan: Discussion about Virge/Sophie/Trophie/...
> Onderwerp: RE: [vtools] encrypted zips / sophie
> 
> 
> Are you trying to scan the native files in the maildirs?
> 
> In my experience, SAV can't do this (it doesn't know how to 
> scan MIME-encoded files).
> 
> I wrote a script that uses Sophie/SAV to accomplish this 
> task, however:  it recurses the specified path, and for each 
> file it munpacks to a temporary directory, scans the 
> resulting files with SAV via Sophie (and here the virus IS 
> detected once the files are munpacked).  If a virus is found, 
> it moves the original infected file to a specified quarantine 
> folder.  It then cleans up the temporary directory.
> 
> I would be happy to send you the script if this is what you 
> are trying to do.
> 
> David Rueter
> [email protected]
> 
> -----Original Message-----
> From: [email protected] [mailto:[email protected]]On
> Behalf Of David Broome
> Sent: Tuesday, April 06, 2004 5:01 PM
> To: [email protected]; Discussion about Virge/Sophie/Trophie/...
> Subject: Re: [vtools] encrypted zips / sophie
> 
> 
> Interesting ...
> 
> Do have the "W32/Bagle-Zip" ide file and current sophos?
> 
> - just thinking of the basics. ;-)
> 
> I'm rejecting hundreds a day.
> 
> Dave,
> --
> David Broome   Senior_Programmer-Analyst.FineArts.UVic.CA  /BSc
> 250.721-6307   [email protected]                    FIA 221
> 
> On Tue, 6 Apr 2004, Jim Savoy wrote:
> 
> >
> > Hi people,
> >
> >            Still struggling with this. I changed all of the 
> Grp flags 
> > in sophie.savi from '2' to '1' and changed Mime from '0' to '1'. I 
> > also added Ed's code to sophie_core.c and recompiled.
> >
> > But when I run this:
> >
> >  # ./sophie -f /tmp/virus.txt   (where virus.txt contains 
> the Bagle-H
> worm)
> >
> > the results are (here's the tail end of them):
> >
> > Sophie version   : 3.04rc2
> > NOTICE           : Scanning file '/tmp/virus.txt'
> > NOTICE           : pSAVI cleaned up and released/terminated
> > NOTICE           : SAVI cleaned up and terminated
> >
> >
> > Shouldn't this display that it found the Bagle-H or Bagle-Zip? As I 
> > mentioned this morning, I have thousands of infected mailboxes and 
> > wish to clean them all out tonight using sophie. But the results of 
> > this test seem to indicate it is still not detecting anything. Any 
> > ideas? Thanks!
> >
> >  - jim -
> >
> >
> >
> > _______________________________________________
> > vtools mailing list
> > [email protected] http://www.vanja.com/list/listinfo.cgi/vtools
> >
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
> 
> 
> 
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>