Sophos and Corrupt Files

[Scott Adkins]

--On Wednesday, February 05, 2003 9:04 PM +0000 Julian Field 
<mailscanner at ECS.SOTON.AC.UK> wrote:

> Please try 3.66a to see if it improves things.

Okay, initial testing shows that the PDF documents that I have still come
back as corrupted.  *shrugs*  I guess these are more problematic docs than
Sophos can deal with.  Did you ever get those PDF files from that guy that
offered them to anyone that wanted to check them out?

> But if you want a list of allowable words to appear in the brackets after
> the attachment name, just for Sophos use, then I could add that for you.
> It would probably be a patch to start with, so you can try it out.
>
> I would really like to see a resolution to this problem too :-)

I tried out the -eec option.  It appears to only affect the exit status
of sophos, but does not change the output of the text in any way... this
means it still says "(corrupt)".  I do notice that the PDF documents no
longer have sophos exitting with a return code of 2, but rather an 8.

We just got a list of exit codes from one of their techs (shorter than
what they told us on the phone), and they are below:

> EEC style:
>       0     No errors or viruses
>       8     Survivable errors encountered
>       12    Compressed files found and decompressed
>       16    Compressed files found and not decompressed
>       20    Viruses found and disinfected
>       24    Viruses found and not disinfected
>       28    Viruses found memory
>       32    Integrity check failed
>       36    Unsurvivable errors encountered
>       40    Scan interrupted

Basically, this is as clear as mud :)  We have requested more information
on what these mean.  Looking at the above, it isn't even clear how exit
code of 12 is exactly an error... And there is nothing in there indicating
that a file had a corrupted header, or the file was password protected,
or there was a locked form cell, or whatever the nature of the problem is.
So, I am not sure how much this is going to help.  Anyways, we are still
trying to get information from them about it.

Thanks,
Scott
-- 
 +-----------------------------------------------------------------------+
      Scott W. Adkins                http://www.cns.ohiou.edu/~sadkins/
   UNIX Systems Engineer                  mailto:adkinss at ohio.edu
        ICQ 7626282                 Work (740)593-9478 Fax (740)593-1944
 +-----------------------------------------------------------------------+
     PGP Public Key available at http://www.cns.ohiou.edu/~sadkins/pgp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 231 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030205/168a158e/attachment.bin