Re: RE : sophie 3.04 libsavi 3.94

Ronan McGlue <[email protected]> Thu, 23 Jun 2005 15:45:28 +0000
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hans-Juergen Schwarz wrote:

> Hello Ronan,
> I had this error with trophie. I think you got a permission problem, 
> so try to compile sophie with user and group exim runs on.
>
> Yust  a Idea - not shure
>
> regards
> Hans-Juergen
>
> Ronan schrieb:
>
>> Martin Zuziak wrote:
>>
>>>> NOTICE : Scanning file 'eicar.com'
>>>> NOTICE : Scanning file 'eicar.com' /DEBUG,31796/
>>>> WARNING : Scan result => 'eicar.com' infected with virus 
>>>> 'EICAR-AV-Test'
>>>> NOTICE : pSAVI cleaned up and released/terminated
>>>> NOTICE : SAVI cleaned up and terminated
>>>>
>>>>
>>>> so it obviously can detect it in this mode but when i fun it as daemon
>>>> /usr/local/bin/sophie -C /etc/sophie.cfg -D
>>>>
>>>> is how i start sophie but it still doesnt detect eicar when run as 
>>>> above.
>>>>   
>>>
>>>
>>>
>>> Then try starting sophie as a daemon and scan the eicar file with the
>>> scan_file sample app:
>>>
>>> scan_file /tmp/sophie eicar.com
>>>
>>> scan_file is in the sample_apps/sock directory in the sophie source
>>> distribution.
>>>  
>>>
>> ok i started it as i normally do
>>
>> /usr/local/bin/sophie -C /etc/sophie.cfg -D
>>
>> and i get the following
>>
>> scan_file /tmp/sophie /home/ronan/sophie-3.04/eicar.com
>> FILE INFECTED: [/home/ronan/sophie-3.04/eicar.com] (VIRUS: 
>> EICAR-AV-Test)
>> root@scarab:/home/ronan/sophie-3.04# so why isnt it being scanned 
>> from exim??
>> i take it this means that there is no problem with sophie and i 
>> should move my problem onto the exim list???
>>
>> ronan
>>
>>
>> _______________________________________________
>> vtools mailing list
>> [email protected]
>> http://www.vanja.com/list/listinfo.cgi/vtools
>
>
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools

yes thats how i did compile it but still it doesnt trap the eicar test 
signature???
confused!!

ronan