Anti-Virus Scanning Commands

The following commands to manage anti-virus scanning are available:

Command

Description

scan <path>

Purpose: Initiate scanning the specified file or directory by the file scanning component Dr.Web File Checker.

Arguments

<path>—path (can be relative) to the file or directory to be scanned.

This argument may be omitted if you use the --stdin or the --stdin0 option. To specify several files that satisfy a certain criterion, use the find utility (see Usage Examples) and the --stdin or --stdin0 option.

Options

-a [--Autonomous]—run standalone instances of Dr.Web Scanning Engine and Dr.Web File Checker to perform the specified scan, shutting them down after it is completed.

Threats detected during standalone scanning will not be added to the common list of threats detected displayed by the threats command, and a centralized protection server will not be notified of them, if Dr.Web Server Security Suite is controlled by it.

--Report <type>—type of the scan report.

Allowed values:

•BRIEF—brief report;

•DEBUG—detailed report;

•JSON—serialized report in the JSON format.

Default value: BRIEF.

--ScanTimeout <time interval>—timeout for scanning one file in milliseconds.

If the value is set to 0, scanning time is not limited.

Default value: 0.

--FollowSymlinks—resolve symlinks automatically.

--PackerMaxLevel <number>—maximum nesting level while scanning packed objects. A packed object is executable code compressed with specialized software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects which may also include packed objects and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--ArchiveMaxLevel <number>—maximum nesting level while scanning archives (.zip, .rar and so on) in which other archives may be enclosed, whereas these archives may also include other archives and so on. The value of this parameter specifies the nesting limit beyond which archives enclosed in other archives are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--MailMaxLevel <number>—maximum nesting level while scanning files of mailers (.pst, .tbb and so on) in which other files may be enclosed, whereas these files may also include other files and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--ContainerMaxLevel <number>—maximum nesting level while scanning other types of objects inside which other objects are enclosed (HTML pages, .jar files and so on). The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--MaxCompressionRatio <ratio>—maximum compression ratio of scanned objects.

The value must be no less than 2.

Default value: 3000.

--MaxSizeToExtract <number>—maximum size for files enclosed in archives. Files which size is greater than the value of this parameter will be skipped when scanning. The size is specified as a number with a suffix (b, kb, mb, gb). If no suffix is specified, the value is treated as a size in bytes.

Default value: (not specified).

--HeuristicAnalysis <On|Off>—enable or disable the heuristic analysis during a scan.

Default value: On.

--Exclude <path>—excluded path. The path can be relative and contain a file mask (with the following wildcards: ? and *, as well as character classes [ ], [! ] and [^ ]).

Optional parameter; can be set more than once.

--OnKnownVirus <action>—action to perform upon detection of a known threat by using the signature-based analysis.

Allowed actions: REPORT, CURE, QUARANTINE, DELETE.

Default value: REPORT.

--OnIncurable <action>—action to perform upon detection an incurable threat or when the curing action (CURE) has failed.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnSuspicious <action>—action to perform upon detection of a suspicious object using the heuristic analysis.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnAdware <action>—action to perform upon detection of adware.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnDialers <action>—action to perform upon detection of a dialer.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnJokes <action>—action to perform upon detection of joke software.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnRiskware <action>—action to perform upon detection of riskware.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnHacktools <action>—action to perform upon detection of a hacktool.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

If a threat is detected in a file inside a container (an archive, an email message and so on), the container is quarantined (QUARANTINE) and not deleted (DELETE).

--stdin—get the list of paths to be scanned from the standard input stream (stdin). Paths in the list must be separated with the new line character (\n).

--stdin0—get the list of paths to scan from the standard input string (stdin). Paths in the list must be separated by the zero character NUL (\0).

When using --stdin and --stdin0 options, the paths on the list should not contain patterns or regular expressions for a search. We recomment that you use the --stdin and --stdin0 options to process a path list generated by an external utility, for example, find in the scan command (see Usage Examples).

bootscan
<device> | ALL

Purpose: Start scanning boot records on specified disks using the file scan component Dr.Web File Checker. Both MBR and VBR records are scanned.

Arguments

<disk drive>—path to the block file of a disk device whose boot record you want to scan. You can specify several disk devices separated by spaces. The argument is mandatory. If ALL is specified instead of the device file, all boot records on all available disk devices will be checked.

Options

-a [--Autonomous]—run standalone instances of Dr.Web Scanning Engine and Dr.Web File Checker to perform the specified scan, shutting them down after it is completed.

Threats detected during standalone scanning will not be added to the common list of threats detected displayed by the threats command, and a centralized protection server will not be notified of them, if Dr.Web Server Security Suite is controlled by it.

--Report <type>—type of the scan report.

Allowed values:

•BRIEF—brief report;

•DEBUG—detailed report;

•JSON—serialized report in the JSON format.

Default value: BRIEF.

--ScanTimeout <time interval>—timeout for scanning one file in milliseconds.

If the value is set to 0, scanning time is not limited.

Default value: 0.

--HeuristicAnalysis <On|Off>—enable or disable the heuristic analysis during a scan.

Default value: On.

--Cure <Yes|No>—attempt or do not attempt to cure detected threats.

If the value is set to No, only a notification about a detected threat is displayed.

Default value: No.

--ShellTrace—display additional debug information when scanning a boot record

procscan

Purpose: Initiate scanning of executables containing the code of currently running system processes with the Dr.Web File Checker component. If a malicious executable file is detected, it is neutralized, and all processes run by this file are forced to terminate.

Arguments: None.

This command is intended only for Dr.Web Server Security Suite distributions running on GNU/Linux OSes.

Options

-a [--Autonomous]—run standalone instances of Dr.Web Scanning Engine and Dr.Web File Checker to perform the specified scan, shutting them down after it is completed.

Threats detected during standalone scanning will not be added to the common list of threats detected displayed by the threats command, and a centralized protection server will not be notified of them, if Dr.Web Server Security Suite is controlled by it.

--Report <type>—type of the scan report.

Allowed values:

•BRIEF—brief report;

•DEBUG—detailed report;

•JSON—serialized report in the JSON format.

Default value: BRIEF.

--ScanTimeout <time interval>—timeout for scanning one file in milliseconds.

If the value is set to 0, scanning time is not limited.

Default value: 0.

--PackerMaxLevel <number>—maximum nesting level while scanning packed objects. A packed object is executable code compressed with specialized software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects which may also include packed objects and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--HeuristicAnalysis <On|Off>—enable or disable the heuristic analysis during a scan.

Default value: On.

--ContainerMaxLevel <number>—maximum nesting level while scanning other types of objects inside which other objects are enclosed (HTML pages, .jar files and so on). The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--Exclude <path>—path to be excluded from scanning. The path can contain a file mask with the following allowed symbols: ? and *, as well as the symbol classes [ ], [! ], [^ ]. The path (including the path with the file mask) must be absolute.

Optional parameter; can be set more than once.

--OnKnownVirus <action>—action to perform upon detection of a known threat by using the signature-based analysis.

Allowed actions: REPORT, CURE, QUARANTINE, DELETE.

Default value: REPORT.

--OnIncurable <action>—action to perform upon detection an incurable threat or when the curing action (CURE) has failed.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnSuspicious <action>—action to perform upon detection of a suspicious object using the heuristic analysis.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnAdware <action>—action to perform upon detection of adware.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnDialers <action>—action to perform upon detection of a dialer.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnJokes <action>—action to perform upon detection of joke software.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnRiskware <action>—action to perform upon detection of riskware.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

--OnHacktools <action>—action to perform upon detection of a hacktool.

Allowed actions: REPORT, QUARANTINE, DELETE.

Default value: REPORT.

If a threat is detected in an executable file, Dr.Web Server Security Suite terminates all processes started by the file.

netscan [<path>]

Purpose: Start distributed scanning of the specified file or directory using the Dr.Web Network Checker agent for network data scanning. If there are no configured connections to other hosts that are running Dr.Web for Unix, then the scanning will be done only using the locally available scan engine (similar to the scan command).

Arguments

<path>—path to the file or directory to be scanned.

If this argument is omitted, data from the stdin input stream will be scanned.

Options

--Report <type>—type of the scan report.

Allowed values:

•BRIEF—brief report;

•DEBUG—detailed report;

•JSON—serialized report in the JSON format.

Default value: BRIEF.

--ScanTimeout <time interval>—timeout for scanning one file in milliseconds.

If the value is set to 0, scanning time is not limited.

Default value: 0.

--PackerMaxLevel <number>—maximum nesting level while scanning packed objects. A packed object is executable code compressed with specialized software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects which may also include packed objects and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--ArchiveMaxLevel <number>—maximum nesting level while scanning archives (.zip, .rar and so on) in which other archives may be enclosed, whereas these archives may also include other archives and so on. The value of this parameter specifies the nesting limit beyond which archives enclosed in other archives are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--MailMaxLevel <number>—maximum nesting level while scanning files of mailers (.pst, .tbb and so on) in which other files may be enclosed, whereas these files may also include other files and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--ContainerMaxLevel <number>—maximum nesting level while scanning other types of objects inside which other objects are enclosed (HTML pages, .jar files and so on). The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--MaxCompressionRatio <ratio>—maximum compression ratio of scanned objects.

The value must be no less than 2.

Default value: 3000.

--MaxSizeToExtract <number>—maximum size for files enclosed in archives. Files which size is greater than the value of this parameter will be skipped when scanning. The size is specified as a number with a suffix (b, kb, mb, gb). If no suffix is specified, the value is treated as a size in bytes.

Default value: (not specified).

--HeuristicAnalysis <On|Off>—enable or disable the heuristic analysis during a scan.

Default value: On.

--Cure <Yes|No>—attempt or do not attempt to cure detected threats.

If the value is set to No, only a notification about a detected threat is displayed.

Default value: No

rawscan <path>

Purpose: Start “raw” scanning of the specified file or directory with Dr.Web Scanning Engine directly, without the use of Dr.Web File Checker.

Threats detected during “raw” scanning are not included in the list of detected threats that can be displayed using the threats command.

 

It is recommended that you use this command only to debug the functioning of Dr.Web Scanning Engine. Note that the command outputs the “cured” status, if at least one threat is neutralized of those threats that are detected in a file (not all threats might be neutralized). Thus, it is not recommended to use this command if you need thorough file scanning. In the latter case it is recommended to use the scan command.

Arguments

<path>—path to the file or directory to be scanned.

Options

--ScanEngine <path>—path to the Unix socket of Dr.Web Scanning Engine. If not specified, a standalone instance of the scan engine will be started (which will be shut down once the scanning is complete).

--Report <type>—type of the scan report.

Allowed values:

•BRIEF—brief report;

•DEBUG—detailed report;

•JSON—serialized report in the JSON format.

Default value: BRIEF.

--ScanTimeout <time interval>—timeout for scanning one file in milliseconds.

If the value is set to 0, scanning time is not limited.

Default value: 0.

--PackerMaxLevel <number>—maximum nesting level while scanning packed objects. A packed object is executable code compressed with specialized software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects which may also include packed objects and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--ArchiveMaxLevel <number>—maximum nesting level while scanning archives (.zip, .rar and so on) in which other archives may be enclosed, whereas these archives may also include other archives and so on. The value of this parameter specifies the nesting limit beyond which archives enclosed in other archives are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--MailMaxLevel <number>—maximum nesting level while scanning files of mailers (.pst, .tbb and so on) in which other files may be enclosed, whereas these files may also include other files and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--ContainerMaxLevel <number>—maximum nesting level while scanning other types of objects inside which other objects are enclosed (HTML pages, .jar files and so on). The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--MaxCompressionRatio <ratio>—maximum compression ratio of scanned objects.

Must be no less than 2.

Default value: 3000.

--MaxSizeToExtract <number>—maximum size for files enclosed in archives. Files which size is greater than the value of this parameter will be skipped when scanning. The size is specified as a number with a suffix (b, kb, mb, gb). If no suffix is specified, the value is treated as a size in bytes.

Default value: (not specified).

--HeuristicAnalysis <On|Off>—enable or disable the heuristic analysis during a scan.

Default value: On.

--Cure <Yes|No>—attempt or do not attempt to cure detected threats.

If the value is set to No, only a notification about a detected threat is displayed.

Default value: No.

--ListCleanItem—output the list of clean (non-infected) files found inside the container that was scanned.

--ShellTrace—enable display of additional debug information when scanning a file.

--Output <path to file>—duplicate the output of the command to the specified file

remotescan
<host> <path>

Purpose: Start scanning the specified file or directory at the specified remote host having connected to it using SSH or Telnet.

Threats detected during remote scanning are not neutralized and are also not added to the list of detected threats displayed using the threats command.

 

This function can be used only for detection of malicious and suspicious files on a remote host. To eliminate detected threats on the remote host, it is necessary to use administration tools provided directly by this host. For example, for routers, set-top boxes, and other “smart” devices, a mechanism for a firmware update can be used; for computing machines, it can be done by connecting to them (as an option, using a remote terminal mode) and by performing corresponding operations in their file system (file removal or moving and so on), or by running an anti-virus software installed on them.

Arguments

•<host>—IP address or a domain name of the remote host to be connected to for scanning.

•<path>—path to the file or directory to be scanned (the path must be absolute).

Options

-l [--Login] <name>—login (user name) used for authorization on the remote host via the selected protocol.

If a user name is not specified, an attempt is made to connect to a remote host as the user who started the command.

-i [--Identity] <path to file>—private key file used for authentication of the specified user via the selected protocol.

The remotescan command is designed to scan SOHO (Small Office / Home Office) routers. A key in the format used by default by the ssh-keygen utility is not supported. To scan a remote host via SSH, a key in the PEM format is required. To generate the key, use the command:

$ ssh-keygen -t rsa -m PEM -f rsa_pem

-m [--Method] <SSH|Telnet>—remote host connection method (protocol).

If the method is not specified, SSH is used.

-p [--Port] <number>—number of the port on the remote host for connecting via the selected protocol.

Default value: Default port for the selected protocol (22 for SSH, 23 for Telnet).

--UseChannels <number>—number of data transfer channels.

Default value: 5.

--Password <password>—password used for authentication of a user via the selected protocol.

Password is passed as plain text.

--Report <type>—type of the scan report.

Allowed values:

•BRIEF—brief report;

•DEBUG—detailed report;

•JSON—serialized report in the JSON format.

Default value: BRIEF.

--ScanTimeout <time interval>—timeout for scanning one file in milliseconds.

If the value is set to 0, scanning time is not limited.

Default value: 0.

--PackerMaxLevel <number>—maximum nesting level while scanning packed objects. A packed object is executable code compressed with specialized software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects which may also include packed objects and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--ArchiveMaxLevel <number>—maximum nesting level while scanning archives (.zip, .rar and so on) in which other archives may be enclosed, whereas these archives may also include other archives and so on. The value of this parameter specifies the nesting limit beyond which archives enclosed in other archives are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--MailMaxLevel <number>—maximum nesting level while scanning files of mailers (.pst, .tbb and so on) in which other files may be enclosed, whereas these files may also include other files and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--ContainerMaxLevel <number>—maximum nesting level while scanning other types of objects inside which other objects are enclosed (HTML pages, .jar files and so on). The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

If the value is set to 0, nested objects are skipped.

Default value: 8.

--MaxCompressionRatio <ratio>—maximum compression ratio of scanned objects.

Must be no less than 2.

Default value: 3000.

--MaxSizeToExtract <number>—maximum size for files enclosed in archives. Files which size is greater than the value of this parameter will be skipped when scanning. The size is specified as a number with a suffix (b, kb, mb, gb). If no suffix is specified, the value is treated as a size in bytes.

Default value: (not specified).

--HeuristicAnalysis <On|Off>—enable or disable the heuristic analysis during a scan.

Default value: On.

--Exclude <path>—path to be excluded from scanning. The path can contain a file mask with the following allowed symbols: ? and *, as well as the symbol classes [ ], [! ], [^ ]. The path (including the path with the file mask) must be absolute.

Optional parameter; can be set more than once.

--TransferListenAddress <address>—address for receiving files transferred from the remote device for scanning.

Optional parameter. If not indicated, an arbitrary address is used.

--TransferListenPort <port>—port for receiving files transferred from the remote device for scanning.

Optional parameter. If not indicated, an arbitrary port is used.

--TransferExternalAddress <address>—address for the remote device to send files for scanning.

Optional parameter. If not indicated, the --TransferListenAddress option value or the outgoing address of the already established session is used.

--TransferExternalPort <port>—port to transfer files for scanning, specified for the remote device.

Optional parameter. If not indicated, an automatically determined port is used.

--ForceInteractive—use the SSH interactive session (only for SSH connections).

Optional parameter.