<div dir="ltr">You will find the docs here: <a href="http://deb.avast.com/lin/doc/techdoc.pdf">http://deb.avast.com/lin/doc/techdoc.pdf</a><div>On Appendix A you will find the description of the scan utility and the output:</div><div><br></div><div>Here just an excerpt:</div><div><br></div><div>Every detected malicious file is reported on a separate
line in the format:
PATH INFECTION
where PATH and INFECTION are separated by a TAB character.
If all files are printed using the -a option, then
the clean files have a "[OK]" string as the infection
name and files that could not be scanned (insufficient
permissions, corrupted archives, ...) have an "[ERROR]"
string as the infection name. Files, that were excluded
from the scan using the -e option have a "[EXCLUDED]"
string as the infection name.
If the -p option is set, PATH contains the archive path
delimited by a "|>" delimiter in case of an archive.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Feb 21, 2018 at 7:11 AM, Dietmar Maurer <span dir="ltr"><<a href="mailto:dietmar@proxmox.com" target="_blank">dietmar@proxmox.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">First, thanks for that patch. Comments inline...<br>
<br>
Note: We prefer patches formatted with "git format-patch" on this list.<br>
<br>
See:<br>
<br>
# man git-format-patch<br>
# man git-send-email<br>
<span class=""><br>
> Put simpy: to scan a file i ran: scan path_of_the file.<br>
> Of course a service in backgroud (like clamd) should be up ad running<br>
> (/bin/avast)<br>
><br>
><br>
> I've modified sub analyze_virus :<br>
><br>
> my ($queue, $filename, $pmg_cfg, $testmode) = @_;<br>
><br>
> my $virus = undef ;<br>
> my $enable_avast = 1 ;<br>
> my $enable_clamav = 1 ;<br>
><br>
> # first analyze with avast<br>
> if ( $enable_avast ) {<br>
> syslog('info', "Starting Avast Scanning...");<br>
> $virus = analyze_virus_avast($queue, $filename, $pmg_cfg) ;<br>
> }<br>
><br>
> if ( ! defined $virus && $enable_clamav ) {<br>
> syslog('info', "Starting Clamav Scanning...");<br>
> $virus = analyze_virus_clam($queue, $filename, $pmg_cfg) ;<br>
> }<br>
><br>
> return $virus ;<br>
><br>
> DESC: I've privileged the use of avast vs clamd , so if avast does not find<br>
> nothing (so $virus is undef) i'm calling the second scan.<br>
<br>
</span>looks OK<br>
<div><div class="h5"><br>
><br>
> Now the sub analyze_virus_avast:<br>
><br>
> my ($queue, $dname, $pmg_cfg) = @_;<br>
><br>
> my $timeout = 60*5;<br>
> my $vinfo;<br>
><br>
> my $clamdscan_opts = "";<br>
><br>
> my ($csec, $usec) = gettimeofday();<br>
><br>
> my $previous_alarm;<br>
><br>
> eval {<br>
><br>
> $previous_alarm = alarm($timeout);<br>
><br>
> $SIG{ALRM} = sub {<br>
> die "$queue->{logid}: Maximum time ($timeout sec) exceeded. " .<br>
> "virus analyze (avast) failed: ERROR";<br>
> };<br>
><br>
> open(CMD, "/bin/scan '$dname'|") ||<br>
> die "$queue->{logid}: can't exec avast: $! : ERROR";<br>
><br>
> my $ifiles;<br>
><br>
> my $response = '';<br>
> #syslog('info', "file is" . $dname);<br>
> #sleep(300);<br>
> while ( defined(my $line = <CMD>) ) {<br>
> if ($line =~ m/^$dname\s+(.*)\s+$/) {<br>
> # output is: /tmp/pippo.txt EICAR Test-NOT virus!!!<br>
> #syslog('info', "grepped virus line is" . $1);<br>
> # we just use the first detected virus name<br>
> $vinfo = $1 if !$vinfo;<br>
> $ifiles = 1 ;<br>
> }<br>
><br>
> $response .= $line;<br>
> }<br>
<br>
</div></div>Do they have some documentation about the output format?<br>
<span class=""><br>
><br>
> close(CMD);<br>
><br>
> alarm(0); # avoid race conditions<br>
><br>
> $ifiles = 0 if ( !$vinfo ) ;<br>
><br>
> if (!defined($ifiles)) {<br>
> die "$queue->{logid}: got undefined output from " .<br>
> "virus detector: $response : ERROR";<br>
<br>
</span>maybe we can mention 'avast' in above error message?<br>
<span class=""><br>
> }<br>
><br>
> if ($vinfo) {<br>
> syslog('info', "$queue->{logid}: virus detected: $vinfo<br>
> (avast)");<br>
> }<br>
> };<br>
> my $err = $@;<br>
><br>
> alarm($previous_alarm);<br>
><br>
> my ($csec_end, $usec_end) = gettimeofday();<br>
> $queue->{ptime_clam} =<br>
> int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);<br>
><br>
> if ($err) {<br>
> syslog ('err', $err);<br>
> $vinfo = undef;<br>
> $queue->{errors} = 1;<br>
> }<br>
><br>
> $queue->{vinfo_clam} = $vinfo;<br>
><br>
> return $vinfo ? "$vinfo (avast)" : undef;<br>
> }<br>
><br>
> DESC: as you can see is mostly equal to clamav one, i've just modified the<br>
> regexp.<br>
> 1 question: is the sub expected to be called on every single part/file of<br>
> the undecoded mail ?<br>
<br>
</span>No. This is called on the raw email data (.eml file).<br>
<span class=""><br>
> 2 question: would I expect from the while ONLY one line of output (this is<br>
> just a natural follow up of question1)<br>
<br>
</span>I guess no. But we need to find some documentation about the output format...<br>
<div class="HOEnZb"><div class="h5"><br>
______________________________<wbr>_________________<br>
pmg-devel mailing list<br>
<a href="mailto:pmg-devel@pve.proxmox.com">pmg-devel@pve.proxmox.com</a><br>
<a href="https://pve.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel" rel="noreferrer" target="_blank">https://pve.proxmox.com/cgi-<wbr>bin/mailman/listinfo/pmg-devel</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">Got problems with Windows? - ReBooT<br>Got problems with Linux? - Be RooT </div>
</div>