VCM2: Command lines for console antivirus

by VirusBuster

eZine lover (@eZine)

Published in 

Virus Collecting Magazine

 · 2 years ago

A correct command line is required to run an antivirus for some reasons. A bad decision could slow down the scanning process unnecessarily.

This article will have two parts. First I will suggest command lines for several antivirus and finally I will give some tips to choose correctly the command line for running a command line antivirus.

I will not explain what each parameter does. If you want to know about them read the documentation of the antivirus.

Suggested command lines:

AVAST (ASHCMD.EXE):

C:\PATH /_ /a /c /i /s /t=A /r=avast

AVG (AVGSCAN.EXE):

/SCAN /ARC /RT /REPORT XXX.LOG /NOMEM /NOHIMEM /NOSELF C:\PATH

AVPDOS32/KAVDOS32 (AVPDOS32.EXE/KAVDOS32.EXE):

/S /Y /* /M /B /P /H /V /U /W=XXX.LOG C:\PATH 
/S /Y /* /M /B /P /H /W=XXX.LOG C:\PATH

First command line performs redundant scanning and second does not.

BitDefender (BDDOSC.EXE):

C:\PATH /f /r /i /nohed /log=xxx.log /a

Dr. Web (DRWEBWCL.EXE):

C:\PATH /ARN /GO /RPXXX.LOG /UPN /NM /AL

F-Prot (F-PROT.EXE):

/REPORT=XXX.LOG /DUMB /ARCHIVE /PACKED /NOMEM /COLLECT C:\PATH

KAV (AVP32.EXE):

/S /W /Q /REDUNDANT C:\PATH 
/S /W /Q C:\PATH

First command line performs redundant scanning and second does not.

Previous to run KAV you must define some options inside the GUI.

McAfee (SCANPM.EXE):

C:\PATH /all /an /vid /d /program /mime /analyze /nomem /!guru /unzip /sub 
/mailbox /rptcor /report=xxx.log

Norton Antivirus (VSCAND.EXE):

C:\PATH /AZ /LOG=XXX.LOG /NA /NB /NC /NM

Nod32 (NOD32DOS.EXE):

/quit+ /pack+ /arch+ /heur- /doboots /all /log=xxx.log C:\PATH

Reliable (Romanian) Antivirus (RAVAV.EXE):

-H off -I off -A -M --report=XXX.LOG C:\PATH

Sophos (SWEEP.EXE):

C:\PATH -all -archive -f -nb -ndi -nk -nm -ns -pb -rec -sc -p=xxx.log -zip

Ukranian Antivirus (UNA32C.EXE):

C:\PATH /ALL /AR /H0 /R /LOG=XXX.LOG

Tips for a good command line:

Doing logs for exchanging we do not care about heuristics, it only slows down the scanning process so it is better to disable them.

If there is a DOS based command line and a Win32 based, it is better to use the Win32 version because very probably it will be faster scanning.