Re: RE : sophie 3.04 libsavi 3.94
Ronan McGlue <[email protected]> Thu, 23 Jun 2005 15:45:28 +0000
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Hans-Juergen Schwarz wrote: > Hello Ronan, > I had this error with trophie. I think you got a permission problem, > so try to compile sophie with user and group exim runs on. > > Yust a Idea - not shure > > regards > Hans-Juergen > > Ronan schrieb: > >> Martin Zuziak wrote: >> >>>> NOTICE : Scanning file 'eicar.com' >>>> NOTICE : Scanning file 'eicar.com' /DEBUG,31796/ >>>> WARNING : Scan result => 'eicar.com' infected with virus >>>> 'EICAR-AV-Test' >>>> NOTICE : pSAVI cleaned up and released/terminated >>>> NOTICE : SAVI cleaned up and terminated >>>> >>>> >>>> so it obviously can detect it in this mode but when i fun it as daemon >>>> /usr/local/bin/sophie -C /etc/sophie.cfg -D >>>> >>>> is how i start sophie but it still doesnt detect eicar when run as >>>> above. >>>> >>> >>> >>> >>> Then try starting sophie as a daemon and scan the eicar file with the >>> scan_file sample app: >>> >>> scan_file /tmp/sophie eicar.com >>> >>> scan_file is in the sample_apps/sock directory in the sophie source >>> distribution. >>> >>> >> ok i started it as i normally do >> >> /usr/local/bin/sophie -C /etc/sophie.cfg -D >> >> and i get the following >> >> scan_file /tmp/sophie /home/ronan/sophie-3.04/eicar.com >> FILE INFECTED: [/home/ronan/sophie-3.04/eicar.com] (VIRUS: >> EICAR-AV-Test) >> root@scarab:/home/ronan/sophie-3.04# so why isnt it being scanned >> from exim?? >> i take it this means that there is no problem with sophie and i >> should move my problem onto the exim list??? >> >> ronan >> >> >> _______________________________________________ >> vtools mailing list >> [email protected] >> http://www.vanja.com/list/listinfo.cgi/vtools > > > _______________________________________________ > vtools mailing list > [email protected] > http://www.vanja.com/list/listinfo.cgi/vtools yes thats how i did compile it but still it doesnt trap the eicar test signature??? confused!! ronan