Re: No SAVIsweepFile in libsavi.so.3.2.07.117

Gunnar Lindberg <[email protected]> Tue, 15 Nov 2005 08:23:48 +0100 (MET)
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
There seems to be more to 3.99 then just symbols in libsavi.so.

Of course I might have screwed up, but neither sophie-3.03 nor
sophie-3.04rc2 seem to recognize previously known (3.95) virii
using 3.99.

Anyone else seen this? Any idea where/how I screwed up?

	Gunnar Lindberg

% sophie (3.03/3.95) -f /tmp/gl.tmp
NOTICE           : Sophie configuration file not specified - falling back to defaults
NOTICE           : Using Sophie configuration file '/etc/sophie.cfg'
NOTICE           : Setting configuration options - please wait...
NOTICE           : Configuration options set
Sophos engine    : Sophos engine version 2.30
Sophie IDE       : Sophos IDE version 3.95 (detects 109827 viruses)
SAVI config      : /etc/sophie.savi
Max processes    : 20 
Socket path      : /var/run/sophie
Umask            : 7
PID file         : /var/run/sophie.pid
Timeout          : 300 seconds
Running as user  : amavis
Socket group     : amavis
Logname          : sophie
Log facility     : 16 (mail)
Log priority     : 5 (notice)
Error strings?   : yes
Timestamps?      : no
Show virus name? : yes
Callbacks?       : yes
limit_classif    : 10
limit_nextfile   : 10000
limit_decompr    : 1000
socket_check     : yes
Sophie version   : 3.03
NOTICE           : Scanning file '/tmp/gl.tmp' 
WARNING          : Scan result => '/tmp/gl.tmp' infected with virus 'W32/Netsky-P'
WARNING          : Scan result => '/tmp/gl.tmp' infected with virus 'W32/Netsky-P'
NOTICE           : pSAVI cleaned up and released/terminated
NOTICE           : SAVI cleaned up and terminated

% sophie (3.03/3.99) -f /tmp/gl.tmp
NOTICE           : Sophie configuration file not specified - falling back to defaults
NOTICE           : Using Sophie configuration file '/etc/sophie.cfg'
NOTICE           : Setting configuration options - please wait...
NOTICE           : Configuration options set
Sophos engine    : Sophos engine version 2.31
Sophie IDE       : Sophos IDE version 3.99 (detects 113113 viruses)
SAVI config      : /etc/sophie.savi
Max processes    : 20 
Socket path      : /var/run/sophie
Umask            : 7
PID file         : /var/run/sophie.pid
Timeout          : 300 seconds
Running as user  : amavis
Socket group     : amavis
Logname          : sophie
Log facility     : 16 (mail)
Log priority     : 5 (notice)
Error strings?   : yes
Timestamps?      : no
Show virus name? : yes
Callbacks?       : yes
limit_classif    : 10
limit_nextfile   : 10000
limit_decompr    : 1000
socket_check     : yes
Sophie version   : 3.03
NOTICE           : Scanning file '/tmp/gl.tmp' 
NOTICE           : pSAVI cleaned up and released/terminated
NOTICE           : SAVI cleaned up and terminated


>scott.walker at sophos.co.jp scott.walker at sophos.co.jp
>Fri Nov 4 03:05:10 CET 2005
>
>FYI, I'm looking into this, but it does seem that the SAVIsweepFile symbol
>has been removed from libsavi (probably because it wasn't being used for
>anything anymore).
>
>In the meantime, if you want to recompile Sophie for SAV 3.99, you make the
>following change to the Sophie configure script.
>
>1. Locate line 4089, it should read
>echo "$as_me:$LINENO: checking for SAVIsweepFile in -lsavi" >&5
>echo $ECHO_N "checking for SAVIsweepFile in -lsavi... $ECHO_C" >&6
>
>2. Before line 4089, add the following line:
>ac_cv_lib_savi_SAVIsweepFile=yes
>
>This effectively tells the configure script to skip this test, but if you
>have libsavi properly installed then it will still compile.
>
>Regards,
>Scott.