Problem with Sophos 3.62 on Linux

[Howard Schultens]

We have used MailScanner for a number of months on our department
mail server, and it has been a life-saver.

I updated to version 4.01-8 using the 'tar' version (not the RPM), and
then downloaded linux.intel.libc6.tar.Z from Sophos for their version 3.62.
I installed everything as the documentation says (I think), and used
/opt/MailScanner/bin/Sophos.install to install the Sophos software.
After starting the system, I get error messages:

Error initialising detection engine - missing part of virus data


The error seems to be in the shell script 'sophos-wrapper'
If I do an strace on it, this comes out at the end:


close(4)                                = 0
open("/usr/local/Sophos/ide/vdl01.vdb", O_RDONLY) = -1 ENOENT (No such
file or directory)
close(3)                                = 0
write(2, "Error initialising detection eng"..., 65Error initialising
detection engine - missing part of virus data
) = 65
brk(0x8084000)                          = 0x8084000
_exit(2)                                = ?

The file 'vdl01.vdb' is in /usr/local/Sophos/lib, not in
/usr/localSophos/ide,
it is put there by the script 'Sophos.install'  There are now a number
of vdl files.  In version 3.62, /usr/local/Sophos/lib contains

libsavi.so.3
libsavi.so.3.2.05.022
vdl-3.62.dat
vdl.dat
vdl01.vdb
vdl02.vdb
vdl03.vdb
vdl04.vdb
vdl05.vdb
vdl06.vdb
vdl07.vdb


whereas for version 3.59 it only has

libsavi.so.3
libsavi.so.3.2.05.012
vdl-3.59.dat
vdl.dat

If I enter as a test

/usr/local/Sophos/bin/sweep /usr/local/Sophos

this apparently runs correctly.

If I try

/opt/MailScanner/lib/sophos-wrapper /usr/local/Sophos

(which should be essentially the same), this gives the error stated
above.   Curiously, if I comment out the lines

LD_LIBRARY_PATH=$PackageDir/lib
export LD_LIBRARY_PATH

in sophos-wrapper, it works OK.  But MailScanner doesn't like that.

In  Readunix.txt in the Sophos distro, I find the paragraph

"b) Multi-file virus data
"
"   Virus information can now be supplied as a number of small files rather
"   than as a single large file.  This will reduce the size of monthly
virus
"   data updates as only the small files that have been updated need to be
"   replaced. Sophos Anti-Virus has been updated to read virus data from
"   the new multi-file format, while retaining support for the original
"   combined format.

which might mean that they have changed something basic.

I have installed a trial version of McAfee uvscan as a temporary measure,
but would prefer to go back to Sophos.

System information:  I am running SuSE Linux 8.0 on a 2-Processor
system, using sendmail as an MTA.

Thanks for any help,

-- Howard Schultens

--------------------------------------------------------------------
Dipl.-Phys. Howard Schultens                    Tel: +49 551 39-5914
Zentrum Physiologie                             FAX: +49 551 39-5923
Humboldtallee 23
37073 Goettingen   mailto:howard at neuro-physiol.med.uni-goettingen.de
Germany               http://www.neuro-physiol.med.uni-goettingen.de
--------------------------------------------------------------------