When the scan task ends, Dr.Web Scanner returns an exit code which determines result of scanning.
The exit code is always constructed as an combination (sum) of codes that are related to the corresponding events of scanning process. The possible events and related codes are following:
Code |
Event |
|---|---|
1 |
Known virus detected |
2 |
Modification of known virus detected |
4 |
Suspicious object found |
8 |
Known virus detected in archive, mailbox or other container |
16 |
Modification of known virus detected in archive, mailbox or other container |
32 |
Suspicious file found in archive, mailbox or other container |
64 |
At least one infected object succesfully cured |
128 |
At least one infected or suspicious file deleted/renamed/moved |
The actual value returned by Dr.Web Scanner is equal to the sum of codes for the events that occurred during scanning. Obviously, the sum can be easily decomposed into separate event codes. For example, return code 9 = 1 + 8 means that known viruses were detected, including viruses in archives, mail archives or containers; curing and others actions were not executed; no other threat events occurred during scanning.
If no threat events occurred during scanning, Dr.Web Scanner returns the exit code 0.
|
Dr.Web Scanner has one feature: in some cases, when no threats were found during scanning, it can return the exit code 128 instead of exit code 0. This case is similar to the case "no threats found" (exit code 0). |
