Re: Problems with sophie/exiscan

Alan,

Sorry to be so long in replying. This is an old issue I have had with
exiscan and sophie in that it is possible for sophie to reply "0", i.e.
good, but with a message like the one you give. There are a few others if
you look at the sophie code. It is possiblle to change the return value
for these errors to 1, Virus found, and the error message becomes the
virus name. With this you can chose what to do in the ACL.

        deny message = $malware_name
        malware = *
        condition = ${if eq {${substr_0_5:$malware_name}}{Error}{1}{0}}

        deny message = VIRUS FOUND ($malware_name)
        malware = *

I do this for encrypted files.

John Linn


On Fri, 22 Oct 2004, Alan Thew wrote:

> I suspect that this is an issue with sophie being unable to handle MIME
> structures well enough (unless there's something missing from my
> sophie.savi file), Clam seems fine with similar mails but does anyone have
> a solution that spots viruses in multi part MIME messages when sophie just
> logs it as the following?
>
> Oct 22 10:59:32 xxxxx sophie[18735]: WARNING          : Error: The file
> passed for scanning represented part of a multi volume archive. The file cannot
> be scanned.
>
> I'm using a simple ACL
>
> warn  log_message = discarding message with virus $malware_name
>        demime = *
>        malware = *
> discard  demime = *
>        malware = *
>
> Something like this came up on the sophie list in 2002 but I don't see a
> solution posted...
>
> Thanks
>
> p.s. before all of you yell "use CLAM as well", this is under serious
> consideration. Is there a solution of using multiple scanners if I wish to
> use different (i.e. not the default) socket locations (exiscan uses the
> defaults as far as I can tell).
>
> --
> Alan Thew                                       [email protected]
> Computing Services,University of Liverpool      Fax: +44 151 794-4442
>
>
>