I have installed sophos and everything seems fine, at least from the "news" I get from the config files. But how can I really test it? Is there any "nice and kind" viruses that I can try with? Or how do I know it works??

Thanks in advance

I have now made an "eicar file" and It works perfectly with my f-secure on windows, but from sophos I do not get any reaction. Anyone with clues? Could it be config problem perhaps

Finally.. I had made a configuration failure in one of my paths..

If you haven't got access to viruses, worms and malware already I'm sure if you d/l selected stuff from say a Packetstorm mirror you'll find lotsa stuff to test it with.

UnSpawn, the thing is I do not want a REAL virus (I sit at my work doing these tests) but a file that the virus protection softwares think is a virus. I have now found one.. thanks..

Anything interesting besides std EICAR stuff?
I'm asking cuz EICAR detection could as well be done tru hardcoded string in the binary if a vendor sees fit, I can't compare it to working with "in the wild" samples. And IMHO working with viruses isn't that difficult if you take precautions...

UnSpawn

Only Eicar, yes, but the virus protection works also with other infected files. I received an infected file with my hotmail and the Antivirus protection detected it..

do you have a "wild sample" that cannot effect my company's network??? I do not wish to try, we actually got some samples from the Sophus company to test with..

thanks..

Hmm. No, I don't hand out live stuff, that would make me an accomplice by any decent standards, and sharing nfo on where to get that kind of stuff will certainly not pass the LQ FAQ/AUP/moderation tests. I'll just say it ain't that hard to find.

we actually got some samples from the Sophos company to test with..
I think your Hotmail example is a better way compared to using Sophos' samples. AV SW tests/reports where vendor submitted samples are used should be viewed with appropriate caution IMNSHO.

UnSpawn

Well we do not only have samples from Sophos and the Eicar file. Actually we got a CD with some games (small) and jokes the company's virus protection and Sophos are reacting with the same files. And also my hotmail virus protection. But these files are not any real viruses..

Viruses under Linux ?
I always heard this could be quite impossible.

Membrax

I have a webserver and also a mailserver on my linux. My customers have windows, os/390 and linux as workstations. They connect to my linux machine through the mailserver to check their mail accounts. When they pick up mail, the virus protection must recognize the viruses..

Well, strictly speaking we're not talking about viruses under Linux cuz there are only about 5 proof of concept samples around but then again on Linux there are other things you could be interested in like worms, LRK's, sniffers and such.

Say you want to get positive ID on odd/unknown binary/tarballs contents. You could be running strings on each of them, but using AV SW is faster and you don't have to remember default backdoor login strings etc etc.

I'm not into spreading FUD and I know I'm handling stuff I know maybe hostile, but hey, if I can determine within 5 mins what I've got I'm happy. Here's an example of someone's / :
DoS:Linux/Slice
Linux/OSF.A
Linux/RST.A
Linux/RST.B
Linux/Slapper.worm.gen
PERL/Rootkit.C*
SH/Rootkit.C*
Trojan:Blitz
Trojan:Linux/RootKit.40
Trojan:Linux/Rootkit.C
Trojan:Linux/RootKit.C
Trojan:Linux/RootKit.C2
Worm:Linux/Lion
If you know the packages names it's easy, if you don't then at least you got a hunch OSF.A indicates rootkit stuff, RST DoS tools/scanners and Slice/Blitz DoS tools or logcleaners.

The mail handler is not attaching/downloading the infected file if the Sophos recognize it. I explained wrong before, my linux has a mail handler, or a sort of a client to the real mail server. The mailserver itself does not handle tcp/ip or smtp and can therefor not be infected by those, or at least not sending worms and those things forward. After the handler the mail goes to a connector that interprets the smtp mail to our protocol..

But thanks for all help, I have now finished testing and will now evaluate..

thanks again

If you have any leads like where you got the HOWTO's/help from on how you set it up the way you described, please post 'em. it would make this thread somewhat complete.

TIA.

UnSpawn,

DO you mean how I installed and configured the Sophos?