<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
</head>
<body>
<br>
<br>
Matt Doherty wrote:<br>
<blockquote type="cite"
cite="midCEEEJMPKAGAEEBLAKIGHMEGFCBAA.Matthew_doherty@datawatch.com">
<meta http-equiv="Content-Type" content="text/html; ">
<meta content="MSHTML 5.50.4916.2300" name="GENERATOR">
<div><span class="787214016-24062002"><font face="Arial"
color="#0000ff" size="2">How can we achieve a simular output using sophos?</font></span></div>
</blockquote>
Is this the kind on info you are looking for?<br>
<br>
Try doing:<br>
<br>
sweep -vv<br>
<br>
Here is the output on my linux box.<br>
<br>
SWEEP virus detection utility<br>
Copyright (c) 1989,2002 Sophos Plc, <a class="moz-txt-link-abbreviated" href="http://www.sophos.com">www.sophos.com</a><br>
<br>
System time 12:08:13, System date 24 June 2002<br>
<br>
Product version : 3.58<br>
Engine version : 2.10<br>
User interface version : 2.03.098<br>
Platform : Linux/Intel<br>
Released : 03 June 2002<br>
Total viruses (with IDEs) : 74067<br>
<br>
Default executable extensions:<br>
<br>
386, 3GR, ADD, ASP, CHM, COM, CPL, DLL, DMD, DOC, DOT,<br>
DRV, EXE, FLT, FON, FOT, I13, IFS, MOD, MPD, MSO, OCX,<br>
OV?, PDR, SCR, SYS, VXD, XL?, VB?, INI, MPP, MPT, HLP,<br>
HT?, SRC, SHS, SHB, PRC, PPS, PPT, POT, PIF, HTML, WBK,<br>
LNK, BAT, SH, PL, EML, NWS, RTF, DBX, PDF, SWF, JS,<br>
JSE<br>
<br>
Files without extensions will also be scanned by default.<br>
<br>
Archive types supported:<br>
<br>
Archive name Command line qualifier Extension(s)<br>
Arj -arj ARJ<br>
Cmz -cmz Z, TAZ<br>
Gzip -gzip GZ, TGZ<br>
Rar -rar RAR<br>
Tar -tar TAR<br>
Zip -zip ZIP<br>
Lha -lha LHA, LZH<br>
MSCompress -mscmp ??_<br>
SfxArchives -sfx EXE<br>
MacBinary -mbin BIN<br>
BinHex -bhex HQX<br>
Uue -uue UUE<br>
<br>
<blockquote type="cite"
cite="midCEEEJMPKAGAEEBLAKIGHMEGFCBAA.Matthew_doherty@datawatch.com">
<blockquote>
<div class="OutlookMessageHeader" dir="ltr" align="left"><font
face="Tahoma" size="2">-----Original Message-----<br>
<b>From:</b> Rishi Gangoly [<a class="moz-txt-link-freetext" href="mailto:rishi@THEARGONCOMPANY.COM">mailto:rishi@THEARGONCOMPANY.COM</a>]<br>
<b>Sent:</b> Monday, June 24, 2002 1:27 PM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</a><br>
<b>Subject:</b> Re: f-prot / aves detects this as a virus !! I think<br>
<br>
</font></div>
Also what's the output of f-prot -virno <br>
<br>
Here is mine: <br>
------------------------------ <br>
SIGN.DEF created 24. June 2002 <br>
SIGN2.DEF created 24. June 2002 <br>
MACRO.DEF created 11. June 2002 <br>
DOS/Windows: 25460 viruses and 14400 Trojans <br>
Word/Excel: 7625 viruses and Trojans <br>
Java: 2 viruses and 115 Trojans <br>
BAT: 1006 viruses and Trojans <br>
IRC INI: 360 viruses and Trojans <br>
Script: 1743 viruses and Trojans <br>
INF: 4 viruses and Trojans <br>
Unix shell: 31 viruses and Trojans <br>
Ami: 2 viruses and Trojans <br>
WinBat: 4 viruses and Trojans <br>
PIF: 18 viruses and Trojans <br>
PalmOS: 4 viruses and Trojans <br>
PHP: 2 viruses and Trojans <br>
Unix: 96 viruses and Trojans <br>
In addition, over 14400 viruses are identified using <br>
generic identification, so the total number of viruses <br>
and Trojans known to F-PROT is somewhere over 65200. <br>
------------------------------ <br>
<br>
<br>
----- Original Message ----- <br>
From: "Rishi Gangoly" <a class="moz-txt-link-rfc2396E" href="mailto:rishi@theargoncompany.com"><rishi@theargoncompany.com></a> <br>
To: <a class="moz-txt-link-rfc2396E" href="mailto:MAILSCANNER@JISCMAIL.AC.UK"><MAILSCANNER@JISCMAIL.AC.UK></a> <br>
Sent: Monday, June 24, 2002 9:22 PM <br>
Subject: Re: f-prot / aves detects this as a virus !! I think <br>
<br>
<br>
> Hi Fracois <br>
> <br>
> What happens when you do : <br>
> <br>
> f-prot -virlist | grep -i Frethem <br>
> <br>
> <br>
> Regards <br>
> <br>
> Rishi <br>
> <br>
> <br>
> <br>
> ----- Original Message ----- <br>
> From: "Francois Caen" <a class="moz-txt-link-rfc2396E" href="mailto:FCaen@CI.LAKEWOOD.WA.US"><FCaen@CI.LAKEWOOD.WA.US></a> <br>
> To: <a class="moz-txt-link-rfc2396E" href="mailto:MAILSCANNER@JISCMAIL.AC.UK"><MAILSCANNER@JISCMAIL.AC.UK></a> <br>
> Sent: Tuesday, June 18, 2002 9:09 PM <br>
> Subject: Re: f-prot / aves detects this as a virus !! I think <br>
> <br>
> <br>
> > -----Original Message----- <br>
> > From: <a class="moz-txt-link-abbreviated" href="mailto:rishi@THEARGONCOMPANY.COM">rishi@THEARGONCOMPANY.COM</a> <br>
> > <br>
> > > Just had another idea. <br>
> > > What's the sum of the infected file that yoy have? <br>
> > > Here is mine. <br>
> > > <br>
> > > <br>
> > > [root f-prot]# sum /tmp/decrypt-password.exe <br>
> > > 07788 35 <br>
> > <br>
> > For all the ones I received, I get the same results: <br>
> > <br>
> > # sum decrypt-password.exe <br>
> > 47131 35 <br>
> > <br>
> > I typically use md5sum, dunno exactly how it differs from sum
but it's a <br>
> standard for software downloads. <br>
> > <br>
> > # md5sum decrypt-password.exe <br>
> > cc695e7e531c18843baa0731a38e969b decrypt-password.exe <br>
> > <br>
> > # sum /usr/local/f-prot/* <br>
> > 49258 1 /usr/local/f-prot/CHANGES <br>
> > 54451 21 /usr/local/f-prot/ENGLISH.TX0 <br>
> > 46493 3 /usr/local/f-prot/INSTALL <br>
> > 38393 3 /usr/local/f-prot/LICENSE <br>
> > 13115 455 /usr/local/f-prot/MACRO.DEF <br>
> > 25947 1 /usr/local/f-prot/README <br>
> > 28940 1 /usr/local/f-prot/SIGN.ASC <br>
> > 16736 1038 /usr/local/f-prot/SIGN.DEF <br>
> > 47624 1 /usr/local/f-prot/SIGN2.ASC <br>
> > 24019 381 /usr/local/f-prot/SIGN2.DEF <br>
> > 30967 12 /usr/local/f-prot/check-updates.sh <br>
> > 43536 7 /usr/local/f-prot/checksum <br>
> > 52218 932 /usr/local/f-prot/f-prot <br>
> > 53109 5 /usr/local/f-prot/f-prot.8 <br>
> > 41567 1 /usr/local/f-prot/f-prot.sh <br>
> > 23276 3 /usr/local/f-prot/f-protwrapper <br>
> > 02783 922 /usr/local/f-prot/fp-def.zip <br>
> > 03152 215 /usr/local/f-prot/macrdef2.zip <br>
> > <br>
> > # md5sum /usr/local/f-prot/* <br>
> > 2d159aceaf924853502ec97dba2414d2 /usr/local/f-prot/CHANGES <br>
> > ccbf77f4141f5d0775ace281bbc7452c /usr/local/f-prot/ENGLISH.TX0
<br>
> > edec255b29f87624b6b1c5a000d4cd91 /usr/local/f-prot/INSTALL <br>
> > 382c9b94925d309068907581a7ee7e7a /usr/local/f-prot/LICENSE <br>
> > bc26349c2892a303fed0928cc95551d3 /usr/local/f-prot/MACRO.DEF
<br>
> > d971c388ec249a1bf699657a823f4f3d /usr/local/f-prot/README <br>
> > 13f975f08f9c0d0e78eda0fa39263d92 /usr/local/f-prot/SIGN.ASC
<br>
> > fa7a8b065075fb0f43ed6073698ae2ae /usr/local/f-prot/SIGN.DEF
<br>
> > 9abb515ed622720bfd27b17356da3c16 /usr/local/f-prot/SIGN2.ASC
<br>
> > cbf14c505c1b904477c943bbf983ee6a /usr/local/f-prot/SIGN2.DEF
<br>
> > f9edeccdb48ca2f51efcfcfedab8cea8 /usr/local/f-prot/check-updates.sh
<br>
> > dc1893dcb0da9f06a718013dab94b60a /usr/local/f-prot/checksum
<br>
> > 6dd38d416efb1b3a15e5a2abb78f038c /usr/local/f-prot/f-prot <br>
> > ef23f6eb09963af8917263603f665d9a /usr/local/f-prot/f-prot.8
<br>
> > 74ac7a4872c003e2f4fbd1494bd76ed7 /usr/local/f-prot/f-prot.sh
<br>
> > f184c6d9ff007949a466d8d78fd2a5ee /usr/local/f-prot/f-protwrapper
<br>
> > 4dc8efd6d9daa451a1515d210664e2f4 /usr/local/f-prot/fp-def.zip
<br>
> > c5c867208efd9d3b398c64d0df50e4e1 /usr/local/f-prot/macrdef2.zip
<br>
> > <br>
> > Hope this helps :-) <br>
> > ------------------------------------------------ <br>
> > Francois Caen <br>
> > Network Information Systems Engineer - Webmaster <br>
> > City of Lakewood, WA <br>
> > (253) 512-2269 <br>
<br>
</blockquote>
</blockquote>
<br>
</body>
</html>