Re: (no subject)

Gerard Earley <[email protected]> Wed, 28 Sep 2005 17:52:31 +0100
Newsgroups gmane.comp.security.virus.vtools
Organization Whitecurve
Message-ID <[email protected]>
This is a cryptographically signed message in MIME format.

--===============0703186136==
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
	micalg=sha1; boundary="------------ms050205040609070604010000"

This is a cryptographically signed message in MIME format.

--------------ms050205040609070604010000
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Serge de Souza wrote:

> Gerard Earley wrote:
>
>> I have been trying to get sophie working with simscan for while now and
>> have finally got simscan talking to sophie successfully. Now though it
>> seems that sophie is running away and scanning every file and directory
>> including the parent directory ".." when it scans.
>>
>>
>>> From sophie running in debug I get:
>>
>>
>> Sophos engine    : Sophos engine version 2.30
>> Sophie IDE       : Sophos IDE version 3.96 (detects 108865 viruses)
>> SAVI config      : /etc/sophie.savi
>> Max processes    : 20
>> Socket path      : /var/run/sophie
>> Umask            : 7
>> PID file         : /var/run/sophie.pid
>> Timeout          : 300 seconds
>> Running as user  : simscan
>> Socket group     : simscan
>> Logname          : sophie
>> Log facility     : 16 (mail)
>> Log priority     : 5 (notice)
>> Error strings?   : yes
>> Timestamps?      : no
>> Show virus name? : yes
>> Callbacks?       : yes
>> limit_classif    : 10
>> limit_nextfile   : 10000
>> limit_decompr    : 1000
>> socket_check     : yes
>> Port             : 4009
>> Temporary dir    : /tmp
>> Sophie version   : 3.04
>> NOTICE           : accept() set, scan type [1] /DEBUG,18748/
>> NOTICE           : Current PROC_COUNT is '0' /DEBUG,18756/
>> NOTICE           : Cleared buf using memset() /DEBUG,18756/
>> NOTICE           : read 42 bytes from socket /DEBUG,18756/
>> NOTICE           : Read: '/var/qmail/simscan/1127913097.446209.18752'
>> /DEBUG,18756/
>> NOTICE           : fork()ed a child - everything seems ok /DEBUG,18748/
>> WARNING          : Could not open dir
>> (/var/qmail/simscan/1127913097.446209.18752/../1125917814.488139.20755/./././././.                                                                            
>> /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.                                                                            
>> /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.                                                                            
>> /./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.                                                                            
>> /././././././././././././././.
>> NOTICE           : Scan of 0 sized file was requested - we refused it
>> /DEBUG,18756/
>> NOTICE           : Scan of 0 sized file was requested - we refused it
>> /DEBUG,18756/
>>
>>
>> the last line is repeated thousands of times and then it seems to be
>> scanning every file/dir it can see, such as
>
>
> <snip>
>
>> Maybe there is a sophie option to stop scanning the parent directory
>> '..' which I think it is doing?
>> :-/)
>> Any help would be appreciated.
>
>
>
> We had a similar problem and came up with a patch, don't think it was
> ever merged, but ever since sophie has been working fine.
>
> Have a look at
> http://www.vanja.com/listarc/vtools/2005-February/001682.html
>
> Tell us if this helped, and what OS are you using ?
>
> Serge
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools

WOW THATS GREAT !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
I WANNA HAVE ALL YOUR CHILDREN!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Maybe this patch should be merged into the main release?


--------------ms050205040609070604010000
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJhTCC
Ax0wggKGoAMCAQICAw868DANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE
ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv
bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDUwODAxMTQyNzM3WhcNMDYwODAxMTQyNzM3
WjBgMQ8wDQYDVQQEEwZFYXJsZXkxDzANBgNVBCoTBkdlcmFyZDEWMBQGA1UEAxMNR2VyYXJk
IEVhcmxleTEkMCIGCSqGSIb3DQEJARYVZ2VyYXJkQHdoaXRlY3VydmUuY29tMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0MQBHh47fP+kFDMv6LFRtYCwnbAAwDWuCTk3HXGe
u7++nN8xERT+TOHJXQc0tpkTGtosoTfHImeforWSaAflenmIu08/HzsiwLhU4MRmaKPBuhON
rZuKLa6AI1zu16Fce5sjFXATLczBwIHyVjmZ/CPBwQesw9HwP4bPuqZeP7QAXgM6VnBPbTMu
Z6nEQJGleT64Qee/JVyji0tI5yL3up1UzHWDSiAWyNdKV//nFTCSDEBL7A3CFOtQodXowbqk
qeu9EC1KlNxT9m27qvzPe8t3v0vqMZoqdJeF/Syoy8batKBQw6FQbCyhYndyIAA+w0wEGWIV
Qw7pMfWTh1eB1QIDAQABo18wXTArBgUrZQEEAQQiMCACAQAwGzAZAgEEBBQzMkdhV1doTnRw
MjNFRkRkcHdDWjAgBgNVHREEGTAXgRVnZXJhcmRAd2hpdGVjdXJ2ZS5jb20wDAYDVR0TAQH/
BAIwADANBgkqhkiG9w0BAQQFAAOBgQCAT6FE1xUmVDg+z1SpEV+l4NiO3JBRSr6aN9KLjMsz
BboWBhdd/Jg5ya+X3sH0av5gp4zCBcYo6c5xFLxWIUJiUHeiR8nm8TlpXZu5ZMj/fHJvCTEJ
vkJit00MyPGoLZ7P22La9O25z7Bez8/91fbFzg91IIbBNbQ0NHg8XO30OTCCAx0wggKGoAMC
AQICAw868DANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3Rl
IENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIElzc3VpbmcgQ0EwHhcNMDUwODAxMTQyNzM3WhcNMDYwODAxMTQyNzM3WjBgMQ8wDQYD
VQQEEwZFYXJsZXkxDzANBgNVBCoTBkdlcmFyZDEWMBQGA1UEAxMNR2VyYXJkIEVhcmxleTEk
MCIGCSqGSIb3DQEJARYVZ2VyYXJkQHdoaXRlY3VydmUuY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEA0MQBHh47fP+kFDMv6LFRtYCwnbAAwDWuCTk3HXGeu7++nN8xERT+
TOHJXQc0tpkTGtosoTfHImeforWSaAflenmIu08/HzsiwLhU4MRmaKPBuhONrZuKLa6AI1zu
16Fce5sjFXATLczBwIHyVjmZ/CPBwQesw9HwP4bPuqZeP7QAXgM6VnBPbTMuZ6nEQJGleT64
Qee/JVyji0tI5yL3up1UzHWDSiAWyNdKV//nFTCSDEBL7A3CFOtQodXowbqkqeu9EC1KlNxT
9m27qvzPe8t3v0vqMZoqdJeF/Syoy8batKBQw6FQbCyhYndyIAA+w0wEGWIVQw7pMfWTh1eB
1QIDAQABo18wXTArBgUrZQEEAQQiMCACAQAwGzAZAgEEBBQzMkdhV1doTnRwMjNFRkRkcHdD
WjAgBgNVHREEGTAXgRVnZXJhcmRAd2hpdGVjdXJ2ZS5jb20wDAYDVR0TAQH/BAIwADANBgkq
hkiG9w0BAQQFAAOBgQCAT6FE1xUmVDg+z1SpEV+l4NiO3JBRSr6aN9KLjMszBboWBhdd/Jg5
ya+X3sH0av5gp4zCBcYo6c5xFLxWIUJiUHeiR8nm8TlpXZu5ZMj/fHJvCTEJvkJit00MyPGo
LZ7P22La9O25z7Bez8/91fbFzg91IIbBNbQ0NHg8XO30OTCCAz8wggKooAMCAQICAQ0wDQYJ
KoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQ
BgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsT
H0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJz
b25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhh
d3RlLmNvbTAeFw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpB
MSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3
dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw
gYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDX
AmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+B79AgAJk16em
u59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/
AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQZXJz
b25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UE
AxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzRUIPqCy7MDaNmrGcP
f6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUaC4J0niVQ
lGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx0x1G
/11fZU8xggM7MIIDNwIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u
c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwg
SXNzdWluZyBDQQIDDzrwMAkGBSsOAwIaBQCgggGnMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0B
BwEwHAYJKoZIhvcNAQkFMQ8XDTA1MDkyODE2NTIzMVowIwYJKoZIhvcNAQkEMRYEFCK1dkml
BNemYJa5FTNU8vVQJPYOMFIGCSqGSIb3DQEJDzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcN
AwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMHgGCSsGAQQB
gjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ
dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB
AgMPOvAwegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3
dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJl
ZW1haWwgSXNzdWluZyBDQQIDDzrwMA0GCSqGSIb3DQEBAQUABIIBAEvclo2554t+oDnqzTFM
Nb+GFaK3yV3clhrG41wvfgjGrffdmtjSnYq46pDLjc0fw2WnZt15zz8yehhZlO63e/SHOE66
NIA2Z+FKFMx9PH0TwdNqayGnJH/lfO6Xtqs4Nu5Xs6FvrhltZAy7ro2hdzTiZtL7pgUeKb9a
QWdFs0oV6w81vs8sBfWvXjq3RV15D2z1EMieDXhSK2PG7/aZoduSNz0RL2ipwmmXBpxlHpt7
ODxbLZ15bJZSeuZJl+7hltH92OXxmG2HYiPRCjgkeDKI0En9fkGKeP77xJ7a40+GcmL5ylSK
BznDyNVg/K7k09HsyffMyMF3+1ZJf7SUdI4AAAAAAAA=
--------------ms050205040609070604010000--

--===============0703186136==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

_______________________________________________
vtools mailing list
[email protected]
http://www.vanja.com/list/listinfo.cgi/vtools

--===============0703186136==--