Sophos killing protected Excel spreadsheets

[Julian Field]

The Sophos command-line switches (for the 'sophos' scanner) are
-sc -f -all -rec -ss -archive -loopback --no-follow-symlinks --no- 
reset-atime -TNEF

You find them from the "ScanOptions" + "CommonOptions" in  
SweepViruses.pm + whatever may be specified in addition in /usr/lib/ 
MailScanner/sophos-wrapper.

For the sophossavi scanner, the options are set by this bit of code:

   my @options = qw(
       FullSweep DynamicDecompression FullMacroSweep OLE2Handling
       IgnoreTemplateBit VBA3Handling VBA5Handling OF95DecryptHandling
       HelpHandling DecompressVBA5 Emulation PEHandling  
ExcelFormulaHandling
       PowerPointMacroHandling PowerPointEmbeddedHandling  
ProjectHandling
       ZipDecompression ArjDecompression RarDecompression  
UueDecompression
       GZipDecompression TarDecompression CmzDecompression  
HqxDecompression
       MbinDecompression !LoopBackEnabled
       Lha SfxArchives MSCabinet TnefAttachmentHandling MSCompress
       !DeleteAllMacros Vbe !ExecFileDisinfection VisioFileHandling
       Mime ActiveMimeHandling !DelVBA5Project
       ScrapObjectHandling SrpStreamHandling Office2001Handling
       Upx PalmPilotHandling HqxDecompression
       Pdf Rtf Html Elf WordB OutlookExpress
     );
   my $error = $SAVI->set('MaxRecursionDepth', 30, 1);

The "Encrypted Messages" options in MailScanner are designed to pick  
up things like SMIME messages and PGP encrypted messages. They are  
not relevant to your problem here.

What I suspect you are looking for is the "Allowed Sophos Error  
Messages" option in MailScanner.conf. The doc for this is:
# Anything on the next line that appears in brackets at the end of a  
line
# of output from Sophos will cause the error/infection to be ignored.
# Use of this option is dangerous, and should only be used if you are  
having
# trouble with lots of corrupt PDF files, for example.
# If you need to specify more than 1 string to find in the error  
message,
# then put each string in quotes and separate them with a comma.
# For example:
#Allowed Sophos Error Messages = "corrupt", "format not supported"

Let me know if this helps or whether you actually need a change in  
the MailScanner code. The allowed-error-messages code was written  
quite a long time ago, and Sophos may have changed their output  
since, making this option useless to you.


On 2 Jun 2005, at 16:35, Jeff A. Earickson wrote:

> Julian,
>
> Setup: Solaris 9, MS 4.42.3, Sophos 3.93 (sophossavi), clamav 0.85.1
> (clamavmodule).
>
> A password protected Excel spreadsheet is getting stopped by Sophos
> with the MailScanner report saying:
>
>    SophosSAVI: 94237001F.xls caused an error: File was encrypted (530)
>
> and the user is howling because they can't email their spreadsheet.
> I ran the Excel file thru sweep by hand, eg:
>
>    === Checking 94237001F.xls with Sophos sweep
>    SWEEP virus detection utility
>    Version 3.94.0 [Solaris/SPARC]
>    Virus data version 3.94, June 2005
>    Includes detection for 105167 viruses, trojans and worms
>    Copyright (c) 1989-2005 Sophos Plc, www.sophos.com
>
>    System time 11:03:52, System date 02 June 2005
>    Command line qualifiers are: -sc -f -all -rec -archive -loopback
>       --no-follow-symlinks --no-reset-atime -tnef
>
>       (BTW, do these settings match MS?  Where to find them in MS?)
>
>    IDE directory is: /opt/sophos/ide
>    .....
>    Full Sweeping
>
>    Password protected file 94237001F.xls
>
>    1 file swept in 3 seconds.
>    1 error was encountered.
>    No viruses were discovered.
>    1 encrypted file was not checked.
>    End of Sweep.
>
> And sweep gives back a return code of 2.  This problem just started  
> in the last month, eg Sophos 3.93.2 and 3.94 releases.
>
> The user has a spreadsheet where the Tools -> Protection -> Protect  
> Sheet
> feature of Excel has been used and a password was entered here.  She
> doesn't know the password.  We cracked it and an unprotected version
> of the file gets a zero return code from Sophos.  ClamAV has no  
> problems with either version of the file.
>
> I have "Block Encrypted Messages = no" in the MailScanner.conf file.
>
> Suggestions please?  Anything that could be done with MailScanner?
> Does MS only look at zero/non-zero return codes from the virus  
> scanners
> to determine virus or not?  Or does it consider non-zero return codes,
> eg "2 means encrypted" (I'm guessing here)?
>
> Jeff Earickson
> Colby College
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!