Re: how broken are antivirus products?

From: Rumen Telbizov <altares(at)einet.bg>
Date: Thu Nov 21 2002 - 02:55:05 EST

Well guys ....

> on Tuesday, November 19, 2002 11:34 you wrote:
is
> >> wrong?
> >> Think about it!
>
> Not really. fsav decodes attachments by default, all others don't. If I
add
> '-mime' to sweep, 116 infections are found.

Well, that is exactly what I said! It DOES SMELL like something is WRONG! Maybe you sould READ the manual FIRST and then TRY some scanning. OR maybe when you really get those WRONG results (123 vs. 1) YOU should guess that YOU have mistaken somewhere.

Btw here is the option from sophos
(http://www.sophos.com/readmes/readvms.txt): (yes I know it is for vms, but so what?)

Changes in June 2002 (3.58)

1. Version 3.58 includes command-line control for most of the features introduced in version 3.57.

       /ELF  - Unix ELF
       /HTML - HTML
       /MIME - MIME
       /RTF  - RTF
       /UUE  - UUEncode

     All options can be negated by prefixing with /NO (e.g. /NOELF).

  b) Please note that MIME is now OFF by default, ELF, HTML and RTF remain ON

     by default.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

That's it. Sophos is a perfect AV scanner. So first RTFM, then write books or
whatever. I quit posting messages in this thread.

EOF Received on Mon Nov 25 22:24:45 2002