[Avcheck] antivirus report msg

Michael Tokarev mjt@tls.msk.ru
Fri, 26 Apr 2002 14:34:53 +0400


Stefano Tabacchiera wrote:
> 
> Hi,
> Linux box running KAV 4.x and avcheck 0.8.
> is there any way to have the *real* antivirus report, instead of 'infected by
> a virus' ? I mean the virus identification.

It's avcheck who passes a message to `infected' handler.  And it uses a text
that was given by a virusscanner if it is available.  Usually, in 99,9% cases,
virusscanner reports type/identification of a virus found.  I saw such message
("infected by a virus") only once - when implemented avcheck<=>avp communication
code and made a bug in avcheck in response parsing code (it was long before first
public avPcheck release ;).  If this your problem persists, it will be interesting
to see some strace's.  Note that I NOT tested avcheck with avp4 - at all.  I
have no idea if protocol was changed or not (but there surely WAS some changes,
partly in response codes for some situations).

Too bad I have no time to set up avp here for testing.

Regards,
 Michael.