Re: sophie 3.04 libsavi 3.94
Scott Walker <[email protected]> Wed, 22 Jun 2005 14:34:30 -0700
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <OFEE7AFF96.26B11CE5-ON88257028.0075752B-88257028.007683EC@sophos.com> |
There are two things going on here. 1) Grp options are always reported as 2 by the engine. The only way to confirm that a group option is set is to look at one of the options it sets. For example, toggle GrpArchiveUnpack and watch the ZipDecompression option. 2) However, there is still an error. The configuration file lists the Grp options first and the individual options next. It also (for some reason) lists _all_ the individual options. Sophie reads the config file from top to bottom, so it first sets the groups, then overwrites any options the groups may have set by setting the individual options (thus making the group options useless). There really is no need for all options to be listed in the default config file. You should only list the options you want to change from their default. Try commenting out ZipDecompression in the config file and toggling the GrpArchiveUnpack option, you should see ZipDecompression change. Scott. [email protected] wrote on 06/22/2005 01:44:32 PM: > Hello - I think we have uncovered a signifigant Sophie problem that may be the > cause of this error. > > I see that 3.04rc2 and 3.04 operate the same in this and so it is a long > standing issue. > > Issue: sophie.savi GrpXXX settings are not respected. > > With testing via 'sophie -c' to show Sophie's configuration I have > seen that the > Grp settings are not picked up. They do not change for the default '2'. > > Can anyone confirm this? > > Dave, > > Quoting Ronan <[email protected]>: > > > hi all, > > As with most of you i was getting the ERROR stream corrupted blabla > > with libsavi 3.93 and even 3.93.2(which was released at the time to try > > and fix the sophie incompatibilty) After reading and AIUI sophos are not > > going to unmake the changes to libsavi for whatever reason and thats why > > 3.04 final was released... > > > > Unfortunately, now I am no longer getting any stream corrupted errors > > but in actual fact am getting apparently no scanning now at all.... > > > > I run the latest exim on my smtp server and have running both clamav and > > sophie on every message. Sophie is first preference because we have a > > site licence for it and clamav runs second... im healthily paranoid! > > > > however when testing with GTUBE sophie doesnt appear to catch or indeed > > log anything whereas clamav as expected detects and sends a 550message... > > > > any clues as to why its not even scanning now?? > > > > libsavi 3.94 > > sophie 3.04 (compiled 32bit becuase of libsavi ) > > Slamd64 (slackware 10.1 64bit linux on dual opterons) > > /lib/libc.so.6 > > GNU C Library stable release version 2.3.2, by Roland McGrath et al. > > > > any other info needed?? > > > > ronan > > > > > > > > _______________________________________________ > > vtools mailing list > > [email protected] > > http://www.vanja.com/list/listinfo.cgi/vtools > > > > > -- > David Broome Programmer_Analyst.FineArts.UVic.CA /BSc /CNA /MCP > 250.721-6307 [email protected] FIA 221 > _______________________________________________ > vtools mailing list > [email protected] > http://www.vanja.com/list/listinfo.cgi/vtools -- Scott Walker Software Integration & Support Engineer, Sophos Tel: 604 484 6883 Web: www.sophos.com Sophos - protecting businesses against viruses and spam