Bill,
Most everything is the same as the 16-bit version. The following works
(won't error in Declude) with avgscan.exe except that it will never
alert Declude to a virus.
SCANFILE2
C:\Progra~1\Grisoft\AVG7\avgscan.exe /NOMEM /NOBOOT /NOHIMEM /NOEXPORT
/NOSELF /ARC /RT /ARCW /RTW /MACROW /REPORT=report.txt
VIRUSCODE2 5
VIRUSCODE2 6
REPORT2 identified
I've found in the last 15 minutes that AVG has their result codes on
their site listed in conjunction with the DOS command line scanners
specifically and no mention of result codes with the 32-bit versions.
The result codes are the same between the two versions. I've already
written tech support asking them if there are different result codes
for avgscan.exe, and if there are none, if they could add them. Here's
what the DOS version provides:
http://www.grisoft.com/faq/us_faqtext.php?id=79&sid=4
Note that I've changed my virus codes for avg.exe based on this list.
The options shared on the Declude site will treat an error as a virus
(result code 2).
I'm thinking that the absence of result codes from avgscan.exe may be
the most likely culprit. Everything else besides that and the extra
space mentioned earlier, seems to be in order. I'm deadset on finding
out conclusively what is at issue here. You can tell how much less
efficient the 16-bit version is in comparison to the 32-bit version
just by calling it on an eicar test file. The 16-bit version isn't
appropriate for any high volume environment.
Matt
Bill Landry wrote:
Matt, what does your report line
look like? If it's:
REPORT1 Infections:
maybe try instead
REPORT1 Identified
without a colon ":". Just curious
if that fixes it, since the report does not contain "Infections:", but
does contain "Identified".
Bill
-----
Original Message -----
Sent:
Friday, February 06, 2004 11:38 PM
Subject:
[Declude.Virus] AVG 7.0 32-bit scanner find...extra space???
Ok, I've been testing things and I think I might have found why Declude
can't make use of AVG 7's 32-bit scanner, avgscan.exe. In the 16-bit
version, the program will report:
Virus identified EICAR_Test
In the 32-bit version, there is an extra space:
Virus identified EICAR_Test
Aside from that difference, I can't find anything else that would
explain it not working. BTW, I did find that they support the /NOBOOT
switch with avgscan.exe despite the lack of this appearing in the help
output, and unlike avg.exe, it will by default scan the boot sectors.
Scott, could you tell me if the extra space is in fact the issue at
hand here? Here's the config and the output from the report.txt file
with the 32-bit version:
----- Command Line -----
C:\Progra~1\Grisoft\AVG7\avgscan.exe /NOMEM /NOBOOT /NOHIMEM
/NOEXPORT /NOSELF /ARC /RT /ARCW /RTW /MACROW /REPORT=report.txt
C:\IMail\Declude\Virus111111111\eicar.com
----- Report.txt -----
AVG 7.0 Anti-Virus System
Copyright (c) GRISOFT,s.r.o. 2003
Program version 7.0 Engine: 718 database version 261.8.3
Command line: [/NOMEM /NOBOOT /NOHIMEM /NOEXPORT /NOSELF /ARC /RT /ARCW
/RTW /MACROW /REPORT=C:\report.txt /SCAN
C:\IMail\Declude\Virus\eicar.com]
"C:\IMail\Declude\Virus\eicar.com" Virus identified EICAR_Test
------------------------------------------------------------
Test start 2/7/2004 2:24:36
Elapsed time 0 sec.
------------------------------------------------------------
Scanned files : 1
Scanned sectors : 0
Infected files : 1
Infected sectors : 0
------------------------------------------------------------
Thanks,
Matt
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
|
