• RC´s needed

    By Bastian Anthon 2 decades ago

    Mailscan needs the RC (return codes) of the AV programm, which is used to scan attachments.



    Please report all available RC´s you have/know here, so I can insert them into the documentation. Include RC´s, programm name and version .



    Requested prgramms are:

    Norton Antivirus 2003

    Norton Antivirus 2004

    AntivVir

    McAfee



    URL´s are welcome !



    Thanks

    Bastian

    • By Danial Zamoldinow 2 decades ago
               Doctor Web for Windows 95/98/Me/NT/2000/XP<br/>
      

      (Dr.Web for Windows 95-XP, without grafical interface, or DrWebWCL)


       Anti-virus laboratory of Igor Daniloff, DialogueScience, Inc.<br/>
      



      RETURN CODES



      The values of the return code and corresponding events are as follows:



      0 - OK, no virus found

      1 - known virus detected

      2 - modification of known virus detected

      4 - suspicious object found

      8 - known virus detected in archive

      16 - modification of known virus detected in archive

      32 - suspicious file found in archive

      64 - at least one virus successfully cured

      128 - at least one infected or suspicious file deleted/renamed/moved



      The actual value returned by the program is equal to the sum of codes for

      the events that occured during scanning. Obviously, the sum can be easily

      decomposed into separate event codes.



      For example, return code 9 = 1 + 8 means that known viruses were detected,

      including viruses in archives; curing and others actions were not executed;

      no other "virus" events occured during scanning.



      E-mail: Antivir@antivir.ru

      WWW: http://www.antivir.ru

      FTP: ftp.antivir.ru, ftp2.antivir.ru, ftp3.antivir.ru

      • Thanks !

        By Bastian Anthon 2 decades ago

        Thanks Danial !



        That was very useful information !



        Sincerely

        Bastian

    • VET AntiVirus RCs

      By Keith L 2 decades ago

      Haven't tried it yet but here is an extract from an email from VET tech support:



      Return codes for vet:

      128 - VIRUS IN HARD DISK BOOT SECTOR NOT CLEANED

      64 - VIRUS FOUND NOT CLEANED

      32 - VIRUS IN HARD DISK BOOT SECTOR CLEANED

      16 - VIRUS IN FLOPPY BOOT SECTOR, OR IN FILE CLEANED

      8 - VIRUS IN MEMORY DISABLED

      4 - VIRUSPRESENT CLEANED

      2 - UNABLE TO ACCESS DISK OR FILE (eg. checking empty drive)

      1 - SCANFAILED

      0 - SUCCESS



      There is a problem with eicar.com though (this could actually be a problem

      with all the files that vet can not clean but rename instead).

      Using MailMarshal files are checked by extracting the file to a temp

      location and then running the vet on it. If the file is not cleanable (like

      in this case) it will be renamed, and as far as vet is concerned it has been

      "cleaned" and code 16 will be returned.

      This is not true because file is not renamed within the message itself.

      There could be a way to get around this problem via batch files that

      MailMarshal is using to invoke vet.



      HOW TO CHECK FOR RETURN CODE:



      Scan a folder that does not contain any infected files.

      Then check return code from the Inocmd32 if it is 0. From the DOS command prompt,

      echo %ERRORLEVEL% shows return code.

      Expected Result: It should return 0 for the return code.

      This can be also done for code 100/101 with eicar.