RE: Sophie Error: "The main body of virus data is out of date"
[email protected] Mon, 27 Jun 2005 16:22:01 -0400
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. --===============0925228575== Content-Type: multipart/alternative; boundary="=_alternative 007003B58525702D_=" This is a multipart message in MIME format. --=_alternative 007003B58525702D_= Content-Type: text/plain; charset="us-ascii" Well, pretty much. Do you have any tools that download new .ide files on a schedule? Hope you don't mind me copying the group, but I'm sure someone else out there would be interested in this as well. ??? I've found that while Sophos claims that new .ide files will not be compatable with engines 3 months out of date, they do give you a month or so of leeway (although with the number of viruses I get hit by, and the amount of new stuff I see regularly, I normally update my engine every two months or so), even though I get new .ide files several times a day. So, even if some .ide files are older than 90 days, they may continue to work, but some newer .ide files won't work with your engine. Upgrading the engine is pretty simple. You want to get the linux version of Sophos Anti Virus, for glibc 2.2 (since you have Redhat 9). The file name is: linux.intel.libc6.glibc.2.2.tar.Z (this file name is the same for every version, so make sure you have the latest one). BTW, I have also had no issues with that version on glibc-2.3, which came with Fedora Core 4. Assuming that everything is in its default location, then untar the file, and it will open into a "sav-install" directory, and in that directory, run "./install.sh" (you probably should stop Sophie first though). The next thing to do, is to go to /usr/local/sav, and "/bin/rm *.ide" to remove all of the old virus identity files, and then download the file: http://www.sophos.com/downloads/ide/###_ides.zip replacing the ###, with the version number of the engine you just installed. Then unzip that file into /usr/local/sav, and you will have all of the latest and greatest virus identities. There are scripts out there to automatically update the .ide files (I use my own, as its a really simple process, and at the time nothing pre-written was available), but you will still want to update your engine every couple of months, manually. -- Robert Geoff Manning <[email protected]> 06/27/2005 03:26 PM To: "'[email protected]'" <[email protected]> cc: Subject: RE: [vtools] Sophie Error: "The main body of virus data is out of date" Also, since the version 3.75a was dates Nov of 2003, does that mean that the engine has been outdated since roughly the beginning of 2004? (90 days past Nov)? We see lots of viruses detected from this server, is that due to the "File ide.name is older than 90 days" ide's are working, but the "File ide.name not loaded (incompatible version number)" are not? Thanks, Geoff -----Original Message----- From: [email protected] [mailto:[email protected]] Sent: Monday, June 27, 2005 2:31 PM To: Discussion about Virge/Sophie/Trophie/... Cc: 'Discussion about Virge/Sophie/Trophie/...'; [email protected] Subject: RE: [vtools] Sophie Error: "The main body of virus data is out of date" Sophos officially only supports identity updates for the last three published engines (a new one is released every month). So, right now, if you engine is older than 3.92 (which it is way older than), then you will need to get your engine updated. So, if you want to keep your virus definitions up to date with Sophos, you will need to update your engine, at least once every three months. When you update your engine, you will want to delete all of the .ide files, and get a new set of them, which matches your version number, at: http://www.sophos.com/downloads/ide/ If you require more help, LMK. Some system information (what version of glibc you're running, variant of linux, etc.) would be helpful. -- Robert Geoff Manning <[email protected]> Sent by: [email protected] 06/27/2005 12:23 PM Please respond to "Discussion about Virge/Sophie/Trophie/..." To: "'Discussion about Virge/Sophie/Trophie/...'" <[email protected]> cc: Subject: RE: [vtools] Sophie Error: "The main body of virus data is out of date" > <snip> > What is the output of sweep -h ? Well, this doesn't paint a pretty picture at all: SWEEP virus detection utility Version 3.75A, November 2003 [Linux/Intel] Includes detection for 88006 viruses, trojans and worms Copyright (c) 1989,2003 Sophos Plc, www.sophos.com System time 12:29:00 PM, System date 27 June 2005 Command line qualifiers are: -h Useful life of SWEEP has been exceeded IDE directory is: /usr/local/sav <snip> File mydoom-w.ide is older than 90 days <snip several more with older than 90 days> File bagle-am.ide not loaded (incompatible version number) <snip several more with incompatible version number> I guess this version is out of date? And perhaps it didn't cause a problem until I restarted the service and it realized it was out of date? _______________________________________________ vtools mailing list [email protected] http://www.vanja.com/list/listinfo.cgi/vtools --=_alternative 007003B58525702D_= Content-Type: text/html; charset="us-ascii" <br><font size=2 face="sans-serif">Well, pretty much. Do you have any tools that download new .ide files on a schedule?</font> <br> <br><font size=2 face="sans-serif">Hope you don't mind me copying the group, but I'm sure someone else out there would be interested in this as well. ???</font> <br> <br><font size=2 face="sans-serif">I've found that while Sophos claims that new .ide files will not be compatable with engines 3 months out of date, they do give you a month or so of leeway (although with the number of viruses I get hit by, and the amount of new stuff I see regularly, I normally update my engine every two months or so), even though I get new .ide files several times a day.</font> <br><font size=2 face="sans-serif">So, even if some .ide files are older than 90 days, they may continue to work, but some newer .ide files won't work with your engine.</font> <br> <br><font size=2 face="sans-serif">Upgrading the engine is pretty simple.</font> <br><font size=2 face="sans-serif">You want to get the linux version of Sophos Anti Virus, for glibc 2.2 (since you have Redhat 9). The file name is:</font> <br><font size=2 face="sans-serif">linux.intel.libc6.glibc.2.2.tar.Z (this file name is the same for every version, so make sure you have the latest one).</font> <br><font size=2 face="sans-serif">BTW, I have also had no issues with that version on glibc-2.3, which came with Fedora Core 4.</font> <br> <br><font size=2 face="sans-serif">Assuming that everything is in its default location, then untar the file, and it will open into a "sav-install" directory, and in that directory, run "<b>./install.sh</b>" (you probably should stop Sophie first though).</font> <br><font size=2 face="sans-serif">The next thing to do, is to go to /usr/local/sav, and "<b>/bin/rm *.ide</b>" to remove all of the old virus identity files, and then download the file:</font> <br><font size=2 face="sans-serif">http://www.sophos.com/downloads/ide/###_ides.zip replacing the ###, with the version number of the engine you just installed.</font> <br><font size=2 face="sans-serif">Then unzip that file into /usr/local/sav, and you will have all of the latest and greatest virus identities.</font> <br> <br><font size=2 face="sans-serif">There are scripts out there to automatically update the .ide files (I use my own, as its a really simple process, and at the time nothing pre-written was available), but you will still want to update your engine every couple of months, manually.</font> <br> <br><font size=2 face="sans-serif">-- Robert</font> <br> <br> <br> <br> <br> <table width=100%> <tr valign=top> <td> <td><font size=1 face="sans-serif"><b>Geoff Manning <[email protected]></b></font> <p><font size=1 face="sans-serif">06/27/2005 03:26 PM</font> <br> <td><font size=1 face="Arial"> </font> <br><font size=1 face="sans-serif"> To: "'[email protected]'" <[email protected]></font> <br><font size=1 face="sans-serif"> cc: </font> <br><font size=1 face="sans-serif"> Subject: RE: [vtools] Sophie Error: "The main body of virus data is out of date"</font></table> <br> <br> <br><font size=2 color=blue face="Arial">Also, since the version 3.75a was dates Nov of 2003, does that mean that the engine has been outdated since roughly the beginning of 2004? (90 days past Nov)?</font> <p><font size=3 face="Times New Roman"> </font> <p><font size=2 color=blue face="Arial">We see lots of viruses detected from this server, is that due to the "File ide.name is older than 90 days" ide's are working, but the "File ide.name not loaded (incompatible version number)" are not?</font> <p><font size=3 face="Times New Roman"> </font> <p><font size=2 face="Arial">Thanks,</font><font size=3 face="Times New Roman"> </font><font size=2 face="Arial"><br> Geoff</font><font size=3 face="Times New Roman"> </font> <p><font size=2 face="Tahoma">-----Original Message-----<b><br> From:</b> [email protected] [mailto:[email protected]]<b><br> Sent:</b> Monday, June 27, 2005 2:31 PM<b><br> To:</b> Discussion about Virge/Sophie/Trophie/...<b><br> Cc:</b> 'Discussion about Virge/Sophie/Trophie/...'; [email protected]<b><br> Subject:</b> RE: [vtools] Sophie Error: "The main body of virus data is out of date"<br> </font> <p><font size=2 face="sans-serif"><br> Sophos officially only supports identity updates for the last three published engines (a new one is released every month).</font><font size=3 face="Times New Roman"> </font><font size=2 face="sans-serif"><br> So, right now, if you engine is older than 3.92 (which it is way older than), then you will need to get your engine updated.</font><font size=3 face="Times New Roman"> </font><font size=2 face="sans-serif"><br> So, if you want to keep your virus definitions up to date with Sophos, you will need to update your engine, at least once every three months.</font><font size=3 face="Times New Roman"> </font><font size=2 face="sans-serif"><br> When you update your engine, you will want to delete all of the .ide files, and get a new set of them, which matches your version number, at:<br> http://www.sophos.com/downloads/ide/</font><font size=3 face="Times New Roman"> <br> </font><font size=2 face="sans-serif"><br> If you require more help, LMK. Some system information (what version of glibc you're running, variant of linux, etc.) would be helpful.</font><font size=3 face="Times New Roman"> <br> </font><font size=2 face="sans-serif"><br> -- Robert</font><font size=3 face="Times New Roman"> <br> <br> <br> </font> <table width=100%> <tr valign=top> <td width=1%> <td width=40%><font size=1 face="sans-serif"><b>Geoff Manning <[email protected]></b></font><font size=3 face="Times New Roman"> </font><font size=1 face="sans-serif"><br> Sent by: [email protected]</font><font size=3 face="Times New Roman"> </font> <p><font size=1 face="sans-serif">06/27/2005 12:23 PM</font><font size=3 face="Times New Roman"> </font><font size=1 face="sans-serif"><br> Please respond to "Discussion about Virge/Sophie/Trophie/..."</font><font size=3 face="Times New Roman"> </font> <td width=57%><font size=1 face="Arial"> </font><font size=1 face="sans-serif"><br> To: "'Discussion about Virge/Sophie/Trophie/...'" <[email protected]></font><font size=3 face="Times New Roman"> </font><font size=1 face="sans-serif"><br> cc: </font><font size=3 face="Times New Roman"> </font><font size=1 face="sans-serif"><br> Subject: RE: [vtools] Sophie Error: "The main body of virus data is out of date"</font></table> <br><font size=3 face="Times New Roman"><br> <br> </font><font size=2 face="Courier New"><br> > <snip><br> > What is the output of sweep -h ?<br> <br> Well, this doesn't paint a pretty picture at all:<br> <br> SWEEP virus detection utility<br> Version 3.75A, November 2003 [Linux/Intel]<br> Includes detection for 88006 viruses, trojans and worms<br> Copyright (c) 1989,2003 Sophos Plc, www.sophos.com<br> <br> System time 12:29:00 PM, System date 27 June 2005<br> Command line qualifiers are: -h<br> <br> Useful life of SWEEP has been exceeded<br> <br> IDE directory is: /usr/local/sav<br> <br> <snip><br> <br> File mydoom-w.ide is older than 90 days<br> <br> <snip several more with older than 90 days><br> <br> File bagle-am.ide not loaded (incompatible version number)<br> <br> <snip several more with incompatible version number><br> <br> <br> I guess this version is out of date? And perhaps it didn't cause a problem<br> until I restarted the service and it realized it was out of date?<br> _______________________________________________<br> vtools mailing list<br> [email protected]<br> http://www.vanja.com/list/listinfo.cgi/vtools<br> </font><font size=3 face="Times New Roman"><br> <br> </font> <br> <br> --=_alternative 007003B58525702D_=-- --===============0925228575== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ vtools mailing list [email protected] http://www.vanja.com/list/listinfo.cgi/vtools --===============0925228575==--