Text 1056, 69 rader
Skriven 2008-11-11 21:21:56 av Mike Luther (1:117/3001.0)
   Kommentar till text 1054 av Johan Zwiekhorst (2:292/100)
Ärende: More stuff gone!
========================
Thanks Johan!

 JZ> AFAIK, PAVCL has no such option. It can automatically disinfect and if 
 JZ> that doesn't work, it will delete the file.

I think I understand the word "can" in the above.  But in view of the program
command options which show up if it is called without any command line
instructions, then I'm not sure.  Thus, of the control options in the PAVCL
executable, what do these options mean and do?

       /CLV - Remove the viruses found
       /OVR - Overwrite before erasing

If I call the PAVCL without the /CLV option above, when the program finds a
problem, does it then just add the file name to the INCID.RPT you cite below?

And, if I call the PAVCL without the /OVR option above, and I have called the
program with the /CLV option above, the program will simply erase the file
completely, as well as add it to the INCID.RPT file?

If that is so, and I call the program with the /OVR option as well as the /CLV
option, what does 'overwrite' mean in this case?

 JZ> If you don't want that, make the file read-only before
 JZ> scanning. You can inspect a file called INCID.RPT 
 JZ> (plain text) in the PavOS2 home directory to see what 
 JZ> infected files it found, and AP.RPT as a general 
 JZ> logfile. PAVCL will return an errorlevel greater than 
 JZ> 128 with the total number of viruses found and an 
 JZ> errorlevel 12 if a disinfection didn't work (only 
 JZ> applicable for the LAST file scanned).

I realize you have pointed me to a site from which I can download a test file
that will produce a report but isn't a virus.  But before I do that, is the
errorlevel an exit parameter?  That I have to treat as such with whatever
program I have used to call the PAVCL executable?

It is interesting that the errorlevel 12 is returned only for the LAST files
scanned.  That's important information if I want to detail out a batch or REXX
file as you suggest below.

 JZ> If you want to
 JZ> automate things, you'll have to write a batch or REXX 
 JZ> file which makes the file(s) to be scanned read-only 
 JZ> and then uses the contents of INCID.RPT and AP.RPT to 
 JZ> determine whether the file has been cleaned of if it 
 JZ> needs to be renamed (and then you can choose the 
 JZ> extension yourself).

The above is why I posted the question about the /OVR command line parameter
for PAVCL and what it means will happen with the use of it.

 JZ> There is a special file created for tests like this. 
 JZ> It is the EICAR.COM file and it is no virus, but all 
 JZ> antivirus programs will treat it as one so it can be 
 JZ> used for testing. See www.eicar.org for information 
 JZ> and to download the file.

OK, I've got some time coming available.  I'll have a look at that site and see
what I can do.  But also really would like to have your comments to the above
before I go digging in the pit!


--> Sleep well; OS/2's still awake! ;)

Mike @ 1:117/3001

--- Maximus/2 3.01
 * Origin: Ziplog Public Port (1:117/3001)