Re: (no subject)
Serge de Souza <[email protected]> Thu, 29 Sep 2005 00:15:37 +0800
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Gerard Earley wrote: > I have been trying to get sophie working with simscan for while now and > have finally got simscan talking to sophie successfully. Now though it > seems that sophie is running away and scanning every file and directory > including the parent directory ".." when it scans. > > >>From sophie running in debug I get: > > Sophos engine : Sophos engine version 2.30 > Sophie IDE : Sophos IDE version 3.96 (detects 108865 viruses) > SAVI config : /etc/sophie.savi > Max processes : 20 > Socket path : /var/run/sophie > Umask : 7 > PID file : /var/run/sophie.pid > Timeout : 300 seconds > Running as user : simscan > Socket group : simscan > Logname : sophie > Log facility : 16 (mail) > Log priority : 5 (notice) > Error strings? : yes > Timestamps? : no > Show virus name? : yes > Callbacks? : yes > limit_classif : 10 > limit_nextfile : 10000 > limit_decompr : 1000 > socket_check : yes > Port : 4009 > Temporary dir : /tmp > Sophie version : 3.04 > NOTICE : accept() set, scan type [1] /DEBUG,18748/ > NOTICE : Current PROC_COUNT is '0' /DEBUG,18756/ > NOTICE : Cleared buf using memset() /DEBUG,18756/ > NOTICE : read 42 bytes from socket /DEBUG,18756/ > NOTICE : Read: '/var/qmail/simscan/1127913097.446209.18752' > /DEBUG,18756/ > NOTICE : fork()ed a child - everything seems ok /DEBUG,18748/ > WARNING : Could not open dir > (/var/qmail/simscan/1127913097.446209.18752/../1125917814.488139.20755/./././././. > /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././. > /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././. > /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././. > /././././././././././././././. > NOTICE : Scan of 0 sized file was requested - we refused it > /DEBUG,18756/ > NOTICE : Scan of 0 sized file was requested - we refused it > /DEBUG,18756/ > > > the last line is repeated thousands of times and then it seems to be > scanning every file/dir it can see, such as <snip> > Maybe there is a sophie option to stop scanning the parent directory > '..' which I think it is doing? > :-/) > Any help would be appreciated. We had a similar problem and came up with a patch, don't think it was ever merged, but ever since sophie has been working fine. Have a look at http://www.vanja.com/listarc/vtools/2005-February/001682.html Tell us if this helped, and what OS are you using ? Serge