Sophie 3.04
Joe Honnold <[email protected]> Mon, 18 Jul 2005 15:15:17 -0500
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
I think Sophie is having issues finding W32/Mytob-BP in my particular configuration and was hoping to get some assistance debugging it further. Sophie is being used in conjunction with a Sun mail server a file socket. If I pass a message confirmed by Sophos support as being a W32/Mytob- BP message it gets delivered to user mailboxes. Is there some issue with my sophie config that prevents tis file from being detected? At first today I thought is was because I was running 3.04rc2 instead of 3.04. [(NB: Releases of Sophie v3 prior to this will not work with versions of Sophos Anti-Virus later than 3.93 (May 2005)] I upgraded to 3.04 and am getting the same result. I can supply an tar ball of the email message that is getting through if any one wants to test their configuration against it. Thanks in advance for your help joe. ===== sunvcs1(root): ./sophie -C ./sophie.cfg -c -v NOTICE : Setting configuration options - please wait... NOTICE : Configuration options set +-----------------------------------+------+-----+ | Configuration parameter | Type |Value| +-----------------------------------+------+-----+ | GrpSuper | 9 | 2 | | GrpArchiveUnpack | 9 | 2 | | GrpSelfExtract | 9 | 2 | | GrpExecutable | 9 | 2 | | GrpInternet | 9 | 2 | | GrpMSOffice | 9 | 2 | | GrpMisc | 9 | 2 | | GrpDisinfect | 9 | 2 | | GrpClean | 9 | 2 | | PEHandling | 3 | 1 | | Emulation | 3 | 1 | | PeEmulator | 3 | 1 | | DynamicDecompression | 3 | 1 | | Upx | 3 | 1 | | ASPack | 3 | 1 | | Fsg | 3 | 1 | | PECompact | 3 | 1 | | ExecFileDisinfection | 3 | 1 | | Ole2FileDisinfection | 3 | 1 | | Elf | 3 | 1 | | MachO | 3 | 1 | | SfxArchives | 3 | 0 | | ConcatenatedArchives | 3 | 0 | | ZipDecompression | 3 | 0 | | ZipUseChd | 3 | 1 | | ArjDecompression | 3 | 0 | | RarDecompression | 3 | 0 | | UueDecompression | 3 | 0 | | GZipDecompression | 3 | 0 | | CmzDecompression | 3 | 0 | | MSCabinet | 3 | 0 | | ISCabinet | 3 | 0 | | ISCabinetFull | 3 | 1 | | ITSS | 3 | 0 | | TarDecompression | 3 | 0 | | TnefAttachmentHandling | 3 | 0 | | TnefEmbedHandling | 3 | 0 | | Lha | 3 | 0 | | MSCompress | 3 | 0 | | ActiveMimeHandling | 3 | 1 | | Pdf | 3 | 1 | | HqxDecompression | 3 | 0 | | MbinDecompression | 3 | 0 | | AppleSingle | 3 | 1 | | Bzip2 | 3 | 0 | | Stuffit | 3 | 0 | | LoopBackEnabled | 3 | 0 | | OpenMacRf | 3 | 1 | | PalmPilotHandling | 3 | 1 | | Rtf | 3 | 1 | | Html | 3 | 1 | | OLE2Handling | 3 | 1 | | WordB | 3 | 1 | | VBA3Handling | 3 | 1 | | VbaOnly | 3 | 0 | | VBA5Handling | 3 | 1 | | DecompressVBA5 | 3 | 1 | | Vba5p | 3 | 0 | | ExcelFormulaHandling | 3 | 1 | | ProjectHandling | 3 | 1 | | ScrapObjectHandling | 3 | 1 | | VisioFileHandling | 3 | 1 | | VisioEmbedHandling | 3 | 0 | | OleDataMsoHandling | 3 | 1 | | OleScriptHandling | 3 | 1 | | OleRawHandling | 3 | 1 | | SrpStreamHandling | 3 | 1 | | Office2001Handling | 3 | 1 | | Vba5Dir | 3 | 0 | | PowerPointMacroHandling | 3 | 1 | | PowerPointEmbeddedHandling | 3 | 1 | | IgnoreTemplateBit | 3 | 1 | | OF95DecryptHandling | 3 | 1 | | DelVBA5Project | 3 | 1 | | Msi | 3 | 0 | | HelpHandling | 3 | 1 | | Skip | 3 | 1 | | Mime | 3 | 0 | | MimeReScan | 9 | 2 | | MimeEmbedded | 3 | 1 | | Base64 | 3 | 0 | | Vbe | 3 | 1 | | OutlookExpress | 3 | 0 | | VbFiltering | 3 | 0 | | UTF16 | 3 | 1 | | Java | 3 | 1 | | Access | 3 | 1 | | CleanJpeg | 3 | 1 | | CleanBmp | 3 | 1 | | CleanGif | 3 | 1 | | CleanRiff | 3 | 1 | | CleanTiff | 3 | 1 | | CleanPng | 3 | 1 | | CleanMp3 | 3 | 1 | | CleanMpeg | 3 | 1 | | Xml | 3 | 0 | | FullMacroSweep | 3 | 0 | | FullPdf | 3 | 0 | | FullSweep | 3 | 0 | | StorageReport | 3 | 0 | | StorageReportAll | 3 | 0 | | StorageDetOnly | 3 | 0 | | DeleteAllMacros | 3 | 0 | | UnixArchive | 3 | 0 | | Rpm | 3 | 0 | | Saveset | 3 | 0 | | MaxRecursionDepth | 2 | 16 | | MaxIntRecDepth | 2 | 25 | | NamespaceSupport | 3 | 3 | | VirusDataDir | 10 | /Volumes/mail/apps/sweep/ sav | VirusDataName | 10 | vdl | IdeDir | 10 | /Volumes/mail/apps/sweep/ sav | AllowPartialVirusData | 3 | 0 | | EnableAutoStop | 3 | 0 | +-----------------------------------+------+-----+ NOTICE : pSAVI cleaned up and released/terminated sunvcs1(root):