[Avcheck] antivirus report msg
Michael Tokarev
mjt@tls.msk.ru
Fri, 26 Apr 2002 14:34:53 +0400
Stefano Tabacchiera wrote:
>
> Hi,
> Linux box running KAV 4.x and avcheck 0.8.
> is there any way to have the *real* antivirus report, instead of 'infected by
> a virus' ? I mean the virus identification.
It's avcheck who passes a message to `infected' handler. And it uses a text
that was given by a virusscanner if it is available. Usually, in 99,9% cases,
virusscanner reports type/identification of a virus found. I saw such message
("infected by a virus") only once - when implemented avcheck<=>avp communication
code and made a bug in avcheck in response parsing code (it was long before first
public avPcheck release ;). If this your problem persists, it will be interesting
to see some strace's. Note that I NOT tested avcheck with avp4 - at all. I
have no idea if protocol was changed or not (but there surely WAS some changes,
partly in response codes for some situations).
Too bad I have no time to set up avp here for testing.
Regards,
Michael.