Re: RE : Trouble with Sophie ?

The most common reason for this kind of problem is the SAVI 
configuration options that are set. One of the significant changes 
between v1 and v3 is the difference in the way it handles setting the 
options.

In particular, in sophie v1, "Full" sweep mode is turned on by default 
(in sophie_init.c,
   #define SOPHIE_SOPHOS_DO_FULL_SWEEP             "1"

Whereas in v3.04rc2, file etc/sophie.savi sets this option off by default:
     FullSweep: 0

This difference may account for the different results you are seeing - 
Full sweep does a byte-by-byte dumb pattern match as well as the 
intelligent algorithmic scan. It can find things that quick mode can't, 
but it is very rare that what it finds is a real threat.

You could also send a sample of the file to [email protected] - see 
http://www.sophos.com/support/knowledgebase/article/1490.html which may 
shed more light on why you're getting the results you are.

Cheers
Rich

Patrice Blot wrote:

>Hello, Bonjour Sebastien :-)
>
>I already had this probleme before.
>I wrote 2 mails to the list but nobody seems to be inspired by my problem.
>
>I noticed that sophie 3.02 didn't detect some virus but Sophie 1.44 does.
>Did you try the old version ?
>
>
>My previous mail was :
>Hello,
>
>I was using sophie 1.44 and upgraded to 3.04 but sophie 3.04 seems not detecting a ot of virus when sophie 1.44 does it well :
>
>/tmp/toscan contain an unpacked mail (reformime) and contain a virus
>sophie1.44 is ons socket /var/run/sophie and sophie3.04 on socket /var/run/sophie3
>
>[root@stanley toscan]# /usr/local/src/sophie-3.04rc2/sample_apps/perl_sock/check_dir.pl /var/run/sophie3 /tmp/toscan/
>[/tmp/toscan//stanmp3music.pif] => response [0]
>[/tmp/toscan//stan1078824021.28873-0.stanley.fc-net.fr] => response [0]
>
>[root@stanley toscan]# /usr/local/src/sophie-3.04rc2/sample_apps/perl_sock/check_dir.pl /var/run/sophie /tmp/toscan/
>[/tmp/toscan//stanmp3music.pif] => response [1:W32/Netsky-D]
>[/tmp/toscan//stan1078824021.28873-0.stanley.fc-net.fr] => response [0]
>
>But sophie=3.04 detect other viruses. 
>of course the 2 uses the same libsavi (> glibc2.2)
>Any idea ?
>
>
>Regards,
>
>Patrice Blot
>FC-NET
> 
>
>
>  
>
>>-----Message d'origine-----
>>De : [email protected] 
>>[mailto:[email protected]] De la part de Sébastien VAUTHEROT
>>Envoyé : mercredi 9 mars 2005 17:29
>>À : [email protected]
>>Objet : [vtools] Trouble with Sophie ?
>>
>>
>>Hello,
>>
>>         I've got a problem with SOPHIE : it doesn't 
>>recognize the virus ID 
>>: W32/Bagle-BK, but sweep yes.
>>
>>Does anyone have the same problem ?
>>
>>Thanks for your help.
>>
>>
>>Best Regards,
>>
>>         Sébastien VAUTHEROT
>>
>>Tél : +33 1 44 27 74 05 - FAX : +33 1 44 27 72 06
>>
>>     CCR - Centre de Calcul Recherche et Réseau JUSSIEU
>>Tour 65/66 5eme étage - Boite 171 - 75252 PARIS CEDEX 05 FRANCE
>>
>>
>>_______________________________________________
>>vtools mailing list
>>[email protected]
>>http://www.vanja.com/list/listinfo.cgi/vtools
>>
>>    
>>
>
>_______________________________________________
>vtools mailing list
>[email protected]
>http://www.vanja.com/list/listinfo.cgi/vtools
>
>  
>