Re: No SAVIsweepFile in libsavi.so.3.2.07.117

There are more virii that go undetected. I haven't tried them all :-)
but at least W32/Netsky-P & W32/Mabutu-A failed.

I've never tried sweep before, but the one that is with 3.99 finds
nothing; however the one with 3.95 says "Useful life of SWEEP has
been exceeded" and finds nothing so there is no way for me to compare.

	Gunnar

>From [email protected]  Wed Nov 16 02:24:23 2005
>In-Reply-To: <[email protected]>
>Subject: Re: [vtools] No SAVIsweepFile in libsavi.so.3.2.07.117
>To: "Discussion about Virge/Sophie/Trophie/..." <[email protected]>
>X-Mailer: Lotus Notes Release 6.5.2 June 01, 2004
>Message-ID: <OFA198591E.A97A3CAE-ON492570BB.0006E5FF-492570BB.00075F46@sophos.com>
>From: [email protected]
>Date: Wed, 16 Nov 2005 10:20:29 +0900

>Gunnar,

>I'd reccommend contacting Sophos Support (along with a sample) to verfify
>whether or not the problem is with libsavi or sophie.  Also, is it only
>Netsky-P samples, or have you found others?  If you scan the file with
>'sweep' does it detect the virus?

>Scott.

>[email protected] wrote on 11/15/2005 04:23:48 PM:

>> There seems to be more to 3.99 then just symbols in libsavi.so.
>>
>> Of course I might have screwed up, but neither sophie-3.03 nor
>> sophie-3.04rc2 seem to recognize previously known (3.95) virii
>> using 3.99.
>>
>> Anyone else seen this? Any idea where/how I screwed up?
>>
>>    Gunnar Lindberg
>>
>> % sophie (3.03/3.95) -f /tmp/gl.tmp
>> Sophie version   : 3.03
>> WARNING          : Scan result => '/tmp/gl.tmp' infected with virus
>> 'W32/Netsky-P'
>>
>> % sophie (3.03/3.99) -f /tmp/gl.tmp
>> Sophos engine    : Sophos engine version 2.31
>> Sophie IDE       : Sophos IDE version 3.99 (detects 113113 viruses)
>> Sophie version   : 3.03