Re: No SAVIsweepFile in libsavi.so.3.2.07.117

Gunnar,

I'd reccommend contacting Sophos Support (along with a sample) to verfify
whether or not the problem is with libsavi or sophie.  Also, is it only
Netsky-P samples, or have you found others?  If you scan the file with
'sweep' does it detect the virus?

Scott.

[email protected] wrote on 11/15/2005 04:23:48 PM:

> There seems to be more to 3.99 then just symbols in libsavi.so.
>
> Of course I might have screwed up, but neither sophie-3.03 nor
> sophie-3.04rc2 seem to recognize previously known (3.95) virii
> using 3.99.
>
> Anyone else seen this? Any idea where/how I screwed up?
>
>    Gunnar Lindberg
>
> % sophie (3.03/3.95) -f /tmp/gl.tmp
> NOTICE           : Sophie configuration file not specified - falling
> back to defaults
> NOTICE           : Using Sophie configuration file '/etc/sophie.cfg'
> NOTICE           : Setting configuration options - please wait...
> NOTICE           : Configuration options set
> Sophos engine    : Sophos engine version 2.30
> Sophie IDE       : Sophos IDE version 3.95 (detects 109827 viruses)
> SAVI config      : /etc/sophie.savi
> Max processes    : 20
> Socket path      : /var/run/sophie
> Umask            : 7
> PID file         : /var/run/sophie.pid
> Timeout          : 300 seconds
> Running as user  : amavis
> Socket group     : amavis
> Logname          : sophie
> Log facility     : 16 (mail)
> Log priority     : 5 (notice)
> Error strings?   : yes
> Timestamps?      : no
> Show virus name? : yes
> Callbacks?       : yes
> limit_classif    : 10
> limit_nextfile   : 10000
> limit_decompr    : 1000
> socket_check     : yes
> Sophie version   : 3.03
> NOTICE           : Scanning file '/tmp/gl.tmp'
> WARNING          : Scan result => '/tmp/gl.tmp' infected with virus
> 'W32/Netsky-P'
> WARNING          : Scan result => '/tmp/gl.tmp' infected with virus
> 'W32/Netsky-P'
> NOTICE           : pSAVI cleaned up and released/terminated
> NOTICE           : SAVI cleaned up and terminated
>
> % sophie (3.03/3.99) -f /tmp/gl.tmp
> NOTICE           : Sophie configuration file not specified - falling
> back to defaults
> NOTICE           : Using Sophie configuration file '/etc/sophie.cfg'
> NOTICE           : Setting configuration options - please wait...
> NOTICE           : Configuration options set
> Sophos engine    : Sophos engine version 2.31
> Sophie IDE       : Sophos IDE version 3.99 (detects 113113 viruses)
> SAVI config      : /etc/sophie.savi
> Max processes    : 20
> Socket path      : /var/run/sophie
> Umask            : 7
> PID file         : /var/run/sophie.pid
> Timeout          : 300 seconds
> Running as user  : amavis
> Socket group     : amavis
> Logname          : sophie
> Log facility     : 16 (mail)
> Log priority     : 5 (notice)
> Error strings?   : yes
> Timestamps?      : no
> Show virus name? : yes
> Callbacks?       : yes
> limit_classif    : 10
> limit_nextfile   : 10000
> limit_decompr    : 1000
> socket_check     : yes
> Sophie version   : 3.03
> NOTICE           : Scanning file '/tmp/gl.tmp'
> NOTICE           : pSAVI cleaned up and released/terminated
> NOTICE           : SAVI cleaned up and terminated
>
>
> >scott.walker at sophos.co.jp scott.walker at sophos.co.jp
> >Fri Nov 4 03:05:10 CET 2005
> >
> >FYI, I'm looking into this, but it does seem that the SAVIsweepFile
symbol
> >has been removed from libsavi (probably because it wasn't being used for
> >anything anymore).
> >
> >In the meantime, if you want to recompile Sophie for SAV 3.99, you make
the
> >following change to the Sophie configure script.
> >
> >1. Locate line 4089, it should read
> >echo "$as_me:$LINENO: checking for SAVIsweepFile in -lsavi" >&5
> >echo $ECHO_N "checking for SAVIsweepFile in -lsavi... $ECHO_C" >&6
> >
> >2. Before line 4089, add the following line:
> >ac_cv_lib_savi_SAVIsweepFile=yes
> >
> >This effectively tells the configure script to skip this test, but if
you
> >have libsavi properly installed then it will still compile.
> >
> >Regards,
> >Scott.
>
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools