RE : RE : Trouble with Sophie ?

Hello Richard,

Thanks for your proposition but when I upgraded I checked all the entry from sophie.savi to reflect the compilation options of sophie1.44.
And sure fullsweep was set to 1.

[root@twin1 etc]# cat  sophie.savi |grep -v '^#' | tr -s '\n'
GrpExecutable: 1
GrpArchiveUnpack: 1
GrpSelfExtract: 1
GrpInternet: 1
GrpMSOffice: 1
GrpMisc: 1
GrpSuper: 0
GrpDisinfect: 0
FullSweep: 1
DynamicDecompression: 1

As far as I'm not a guru in sophie options I can have made a mistake.

I'm not sure that sophos is in fault because sweep and sophie 1.44 catched the virus using the same test directory.
Actually this directory was a mail passed through reformime. We are using Q-S.

We changed our linux box recently (was RH8 -> Fed3). So I retry to use sophie 3.04. And so far have no problem.

I made a RPM for Fed3 of sophie tuned for Q-S if someone need it...

Regards,

Patrice Blot
FC-NET
 


> -----Message d'origine-----
> De : [email protected] 
> [mailto:[email protected]] De la part de Richard Baldry
> Envoyé : jeudi 10 mars 2005 00:11
> À : Discussion about Virge/Sophie/Trophie/...
> Objet : Re: RE : [vtools] Trouble with Sophie ?
> 
> 
> The most common reason for this kind of problem is the SAVI 
> configuration options that are set. One of the significant changes 
> between v1 and v3 is the difference in the way it handles setting the 
> options.
> 
> In particular, in sophie v1, "Full" sweep mode is turned on 
> by default 
> (in sophie_init.c,
>    #define SOPHIE_SOPHOS_DO_FULL_SWEEP             "1"
> 
> Whereas in v3.04rc2, file etc/sophie.savi sets this option 
> off by default:
>      FullSweep: 0
> 
> This difference may account for the different results you are 
> seeing - 
> Full sweep does a byte-by-byte dumb pattern match as well as the 
> intelligent algorithmic scan. It can find things that quick 
> mode can't, 
> but it is very rare that what it finds is a real threat.
> 
> You could also send a sample of the file to [email protected] - see 
> http://www.sophos.com/support/knowledgebase/article/1490.html 
> which may 
> shed more light on why you're getting the results you are.
> 
> Cheers
> Rich
> 
> Patrice Blot wrote:
> 
> >Hello, Bonjour Sebastien :-)
> >
> >I already had this probleme before.
> >I wrote 2 mails to the list but nobody seems to be inspired 
> by my problem.
> >
> >I noticed that sophie 3.02 didn't detect some virus but 
> Sophie 1.44 does.
> >Did you try the old version ?
> >
> >
> >My previous mail was :
> >Hello,
> >
> >I was using sophie 1.44 and upgraded to 3.04 but sophie 3.04 
> seems not detecting a ot of virus when sophie 1.44 does it well :
> >
> >/tmp/toscan contain an unpacked mail (reformime) and contain a virus
> >sophie1.44 is ons socket /var/run/sophie and sophie3.04 on 
> socket /var/run/sophie3
> >
> >[root@stanley toscan]# 
> /usr/local/src/sophie-3.04rc2/sample_apps/perl_sock/check_dir.
> pl /var/run/sophie3 /tmp/toscan/
> >[/tmp/toscan//stanmp3music.pif] => response [0]
> >[/tmp/toscan//stan1078824021.28873-0.stanley.fc-net.fr] => 
> response [0]
> >
> >[root@stanley toscan]# 
> /usr/local/src/sophie-3.04rc2/sample_apps/perl_sock/check_dir.
> pl /var/run/sophie /tmp/toscan/
> >[/tmp/toscan//stanmp3music.pif] => response [1:W32/Netsky-D]
> >[/tmp/toscan//stan1078824021.28873-0.stanley.fc-net.fr] => 
> response [0]
> >
> >But sophie=3.04 detect other viruses. 
> >of course the 2 uses the same libsavi (> glibc2.2)
> >Any idea ?
> >
> >
> >Regards,
> >
> >Patrice Blot
> >FC-NET
> > 
> >
> >
> >  
> >
> >>-----Message d'origine-----
> >>De : [email protected] 
> >>[mailto:[email protected]] De la part de Sébastien VAUTHEROT
> >>Envoyé : mercredi 9 mars 2005 17:29
> >>À : [email protected]
> >>Objet : [vtools] Trouble with Sophie ?
> >>
> >>
> >>Hello,
> >>
> >>         I've got a problem with SOPHIE : it doesn't 
> >>recognize the virus ID 
> >>: W32/Bagle-BK, but sweep yes.
> >>
> >>Does anyone have the same problem ?
> >>
> >>Thanks for your help.
> >>
> >>
> >>Best Regards,
> >>
> >>         Sébastien VAUTHEROT
> >>
> >>Tél : +33 1 44 27 74 05 - FAX : +33 1 44 27 72 06
> >>
> >>     CCR - Centre de Calcul Recherche et Réseau JUSSIEU
> >>Tour 65/66 5eme étage - Boite 171 - 75252 PARIS CEDEX 05 FRANCE
> >>
> >>
> >>_______________________________________________
> >>vtools mailing list
> >>[email protected]
> >>http://www.vanja.com/list/listinfo.cgi/vtools
> >>
> >>    
> >>
> >
> >_______________________________________________
> >vtools mailing list
> >[email protected]
> >http://www.vanja.com/list/listinfo.cgi/vtools
> >
> >  
> >
> 
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>