Re: (no subject)

Serge de Souza <[email protected]> Thu, 29 Sep 2005 00:15:37 +0800
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Gerard Earley wrote:
> I have been trying to get sophie working with simscan for while now and
> have finally got simscan talking to sophie successfully. Now though it
> seems that sophie is running away and scanning every file and directory
> including the parent directory ".." when it scans.
> 
> 
>>From sophie running in debug I get:
> 
> Sophos engine    : Sophos engine version 2.30
> Sophie IDE       : Sophos IDE version 3.96 (detects 108865 viruses)
> SAVI config      : /etc/sophie.savi
> Max processes    : 20
> Socket path      : /var/run/sophie
> Umask            : 7
> PID file         : /var/run/sophie.pid
> Timeout          : 300 seconds
> Running as user  : simscan
> Socket group     : simscan
> Logname          : sophie
> Log facility     : 16 (mail)
> Log priority     : 5 (notice)
> Error strings?   : yes
> Timestamps?      : no
> Show virus name? : yes
> Callbacks?       : yes
> limit_classif    : 10
> limit_nextfile   : 10000
> limit_decompr    : 1000
> socket_check     : yes
> Port             : 4009
> Temporary dir    : /tmp
> Sophie version   : 3.04
> NOTICE           : accept() set, scan type [1] /DEBUG,18748/
> NOTICE           : Current PROC_COUNT is '0' /DEBUG,18756/
> NOTICE           : Cleared buf using memset() /DEBUG,18756/
> NOTICE           : read 42 bytes from socket /DEBUG,18756/
> NOTICE           : Read: '/var/qmail/simscan/1127913097.446209.18752'
> /DEBUG,18756/
> NOTICE           : fork()ed a child - everything seems ok /DEBUG,18748/
> WARNING          : Could not open dir
> (/var/qmail/simscan/1127913097.446209.18752/../1125917814.488139.20755/./././././.                                                                             
> /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.                                                                             
> /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.                                                                             
> /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.                                                                             
> /././././././././././././././.
> NOTICE           : Scan of 0 sized file was requested - we refused it
> /DEBUG,18756/
> NOTICE           : Scan of 0 sized file was requested - we refused it
> /DEBUG,18756/
> 
> 
> the last line is repeated thousands of times and then it seems to be
> scanning every file/dir it can see, such as

<snip>

> Maybe there is a sophie option to stop scanning the parent directory
> '..' which I think it is doing?
> :-/)
> Any help would be appreciated.


We had a similar problem and came up with a patch, don't think it was 
ever merged, but ever since sophie has been working fine.

Have a look at
http://www.vanja.com/listarc/vtools/2005-February/001682.html

Tell us if this helped, and what OS are you using ?

Serge