

                   Doctor Web, Ltd.

             Dr.Web(R) Scanner for FreeBSD 
                Administrator Manual

                   Version 4.33

====================================================================
The material published herein is the property of Doctor Web, Ltd.
and may not be reproduced in any form without written permission of
Doctor Web, Ltd. and proper attribution.

Dr.Web is a registered trademark of Doctor Web, Ltd.

Other product names mentioned herein are trademarks or registered
trademarks of their respective companies.

There might be further improvements and changes in the software not
described in this manual. The corrected and supplemented versions of
this manual are available at www.drweb.com.
====================================================================

(C) Doctor Web, Ltd., 2005
Russia, Moscow - Saint Petersburg
http://www.drweb.com/


          CONTENTS

1. INTRODUCTION    
  1.1. What is this manual about?      
  1.2. Dr.Web's reqirements to OS and hardware      
2. INSTALLING Dr.Web(R)
  2.1. Installing Dr.Web(R) for FreeBSD 
  2.2. Package registration. License key file  
  2.3. Updating programs and virus bases       
3. USING Dr.Web(R) SCANNER   
  3.1. Location of package files       
  3.2. Starting the scanner   
  3.3. Command line options   
  3.4. Configuring the scanner
4. CONTACTS



                       1. INTRODUCTION

1.1. What is this manual about

The present manual describes the Dr.Web antivirus program for
Unix-based systems - Linux, FreeBSD, SunOS Solaris and OpenBSD.

The manual is meant for the employee concerned in the antivirus
security (antivirus security system administrator), named
administrator in this manual.

It is generally known, that counteraction to viruses in Unix-based
operating systems (further named as Unix-systems) has two
peculiarities. The first of them concerns the protection of the local
system and user data from the destructive impact of viral programs.
The second peculiarity deals with the diagnostics and neutralization
of viruses when using Unix-systems as platforms for communication
services, first of all, in mail servers, file servers of local
networks, etc. While the viruses can be (and in most cases they are)
designed not specifically for Unix-systems - through local networks
and mail services they distribute ordinary Windows-viruses, including
macro viruses for Word, Excel and other office applications.

The Dr.Web antivirus program for Unix-systems performs two functions.
On the one hand, it is the Dr.Web Scanner for detection and curing the
viruses on the local computer. The Graphical interface module
considerably facilitates setting of parameters and administration of
the scanning process on the local computer.

On the other hand, the package includes the resident component (the
daemon) Dr.Web Daemon (drwebd), which can be used almost in any data
processing layouts as an external plug-in of the antivirus filter. For
example, mail systems (such as Communigate Pro, Sendmail, Postfix,
Exim, QMail, ZMailer and other) can be rather easily and flexibly
tuned for using the Dr.Web Daemon to check the e-mail messages
transmitted by the mail server.

The aspect of using the Dr.Web program in Unix-systems, namely, the
detection and neutralization of viruses in local computers will be
covered in the present manual first. Here, we would like to emphasize
the following points:

- general notions on the programs, the differences between the
  versions (chapter 1);
- program's installation from packages of different formats (chapter 2);
- using the virus scanner mainly on a local computer (chapter 3).

The second aspect is reflected in a separate document (readme.daemon). 

At the end of this manual you will find the contact information of the
technical support service.

The Dr.Web antivirus program is in constant development. The add-ons
of the databases of the known viruses are released, as a rule, several
times a day. The program itself gets upgraded too. The diagnostics
techniques and counteraction to viruses, as well as integration with
other applications of Unix-systems get constantly improved in the
program. Besides, the list of applications compatible with Dr.Web is
expanding. And it is not improbable, that some settings and functions
of the current version will differ from those described in this
manual. To get the present-day information on the program read the
electronic documentation included into the delivery package, as it
will be described in section 3.1.


1.2. Dr.Web(R) requirements to OS and Computer

'
Dr.Web for FreeBSD works with FreeBSD versions 3.xdnl close if_freebsd

Regarding the hardware, the Dr.Web requirements are similar to those
of the console (text) mode for FreeBSD. To install the programs (the
scanner and the daemon) approximately 2.5 Mb of the disk space is
required.



                 2. INSTALLING Dr.Web(R)
                     
NOTE. The distribution filenames and names of intermediate directories
created during the installation depend upon the antivirus version and
the OS.


2.1. Installing Dr.Web(R) for FreeBSD


NOTE. The examples sited below, for the better understanding purpose,
describe installation of the 4.33 antivirus for FreeBSD version 4.x.
In other cases, the names of files and directories will differ
respectively.

The Dr.Web distribution for this OS is delivered in two formats:

- as bsd package drweb-4.33-freebsd4.tgz, designed for FreeBSD
  packages managing system;
- as tarball-archive (drweb-4.33-freebsd4.tar.gz), for manual
  installation.

Follow the instruction to install the package:

> pkg_add drweb-4.33-freebsd4.tgz

If you want to use the tarball-archive for installation, unpack the
archive. The drweb-4.33-freebsd4 directory containing the directory
tree will be created. Copy the tree to the root directory (you can
also specify your own directory structure, but in this case you should
edit the program configuration file, see p.3.4).

Example:

> tar xzf drweb-4.33-freebsd4.tar.gz
> cp -pR drweb-4.33-freebsd4/* /

Then, create a drweb account and set up correct permissions for the
directories created:

> chown -R drweb:drweb /usr/local/drweb/lib 
> chown -R drweb:drweb /var/drweb


2.2. Package registration. License key file

User's rights to use the antivirus are regulated by the special file
called the key file. The key file contains, in particular, the
following information:

- list of antivirus components licensed to the user;
- the licensed version of the antivirus;
- the license term of the antivirus;
- virus definitions automatic updates period (also called the
  "subscription period" which may not be equal to the license period);
- other restrictions (i.e. the number of protected PCs, etc.).

The key file has the key extension and must be located by default in
the installation directory.

WARNING. The key file has a write-protected  and therefore must
not be edited. Editing the file makes it invalid. Consequently, it is
not recommended to open your key file with a text editor, which may
occasionally corrupt it.

Users who have purchased the antivirus from the Doctor Web's certified
partners obtain a license key file. The parameters of the key file are
specified according to the license the user has paid for. The license
key file contains the name of the user (or a company name), and the
name of the selling company.

For evaluation purposes users may also obtain demo key files. Demo key
files allow to enjoy full functionality of the program and the virus
definitions updates, but have a limited term of use and no users'
support is provided.

The key file may be supplied with the key extension, or as a zip
archive containing the key file.

The key file may be received in one of the following ways.

- Supplied or sent as a zip archive containing a file with the key
  extension (usually after the registration on the web site, explained
  below). Extract the key file using the appropriate archiving tool
  and place it to /usr/local/drweb directory.
- Included into the distribution package.
- Supplied on a media as a file with the key extension. The user
  should copy it manually to /usr/local/drweb directory.

The license key file is sent to users via email, as a rule, after the
registration on the web site (the location of the web site is
specified in the registration card accompanying the product). Visit
the indicated site, fill in the web form with the customer data and
put in the registration serial number (printed in the registration
card). The key file will be sent to the specified address.


2.3. Updating programs and virus bases

As any other antivirus package the Dr.Web antivirus requires regular
updating of the virus bases of the known viruses.

For automatic receipt and installation of the virus bases' add-ons a
special script should be used from the update subdirectory of the
program's executable files directory:

> /usr/local/drweb/update.pl

Details of settings and using of this script are described in a
separate document (readme.updater). 



           3. USING Dr.Web(R) SCANNER

This section describes the location of the Dr.Web program files,
program's startup procedure, command line options and the
configuration file structure.


3.1. Location of package files

The Dr.Web is installed by default to the directories further named as
/usr/local/drweb, /usr/local/etc/drweb and /var/drweb. The
subdirectories structure is created in these directories.

The /usr/local/drweb directory houses the executable program modules -
the scanner (drweb) and the daemon (drwebd).

In its lib subdirectory the antivirus kernel as a loaded library is
located (drweb32.dll).

The database of known viruses - /var/drweb/bases/drwebase.vdb.

Configuration file - /usr/local/etc/drweb/drweb32.ini.

Language resource files (e.g., for operation with Russian interface) -
/usr/local/drweb/lib/ru_scanner.dwl.

The documentation is located in the /usr/local/drweb/doc subdirectory.
The program manuals are represented as usual text files in two
variants - in English and Russian (KOI8-R encoded).

In the subdirectory of the /usr/local/drweb/update directory a perl-
script for updating the program (update.pl) is located.

The subdirectory of the /var/drweb/infected is meant for moving
there files if the reaction of the program is set to detect the
infected or suspicious files.


3.2. Starting the scanner

The Dr.Web scanner is a program with the textual interface functioning
in the console mode (or in the terminal emulator window in X Window).
It is launched by the sequence of instructions

> /usr/local/drweb/drweb 

or, if the /usr/local/drweb directory is put into the PATH command
shell environment variable - from an arbitrary directory. The last
variant is not recommended for safety reasons, as well as making a
reference to the drweb executable file in any directory like /bin,
/usr/bin etc.

The scanner can be started both under the name of an administrator and
under a user name. The check for viruses will be made only in the
directories a user has a read access to, and the infected files will
be cured in the directories such a user has a write access to (as a
rule, this is a user's home directory, $HOME). Besides, there exist
other restrictions of the program's functionality started in the user
mode (e.g., moving and renaming of infected files).

The scanner being started, the headpiece with the name of the program
and the platform (FreeBSD), the version number, the date of its release
and the contact information are displayed. It is followed by a user's
registration information and report on the antivirus database load,
including add-ons (if any installed):

  Dr.Web (R) for FreeBSD, version 4.32.1 (2004-08-30)
  Copyright (c) Igor Daniloff, 1992-2004
  Support service: http://support.drweb.com
  To purshase: http://buy.drweb.com
  Loading /var/drweb/bases/drwtoday.vdb - Ok,  virus records: 5
  Loading /var/drweb/bases/drw43203.vdb - Ok,  virus records: 409
  Loading /var/drweb/bases/drw43202.vdb - Ok,  virus records: 543
  Loading /var/drweb/bases/drwebase.vdb - Ok,  virus records: 51982
  Loading /var/drweb/bases/drw43201.vdb - Ok,  virus records: 364
  Total virus records: 53303
  Key file: /usr/local/drweb/drweb32.key
  Key file number: XXXXXXXXXX

After that the command shell invitation is returned. All other actions
on detection and neutralization require specification of the command
line options.


3.3. Command line options

The program gets started as follows (suppose that the /usr/local/drweb
directory is the current directory):

> ./drweb -path=<path> [options]

where <path> means the path to the checked directory or the tested
files mask. The scanner started with empty options, with the path set
as an argument only, will check the specified directory using the
default set of options (we will further return to it in this section).
The next example shows how to enable checking of a users home
directory:

> ./drweb -path=~

When the check is finished, the program outputs the report as follows:

  Scan report for "/opt/drweb/tmp":
  Scanned       : 34/32          Cured      : 0
  Infected      : 5/5            Deleted    : 0
  Modifications : 0/0            Renamed    : 0
  Suspicious    : 0/0            Moved      : 0
  Scan time     : 00:00:02       Scan speed : 5233 Kb/s

The numbers divided by the "/" character mean: the first - the total
number of files, the second - the number of files in archives.
Besides, if a file infected with the known virus, or suspicious files
are detected, the following lines are displayed before the summary
report:

  /path/file infected [by a virus] VIRUS_NAME

Be aware that the Dr.Web distribution contains a specially designed
readme.eicar text file. With the help of a text editor one can easily
make the eicar.com program (read this file for instructions), which
acts as a virus causing the output of the following report:

  DEFAULT_BIN_PATH/doc/eicar.com infected by Eicar Test File (Not a Virus!)

Actually, this file is not a virus, but it is usually used to test the
reaction of the antivirus to the presence of a virus. All modern
antivirus programs include information on it to its virus bases.

As for any other Unix-program, the Dr.Web scanner supports multiple
command line options. They are separated from the specified path by a
blank and prefixed by the - (hyphen) symbol. To get the complete list
of options run the drweb program with the following options: -? or -help.

The main program options can be classified in the following way:

- scan area options;
- diagnostics options;
- actions options;
- interface options.


The scan area options determine where the check for viruses should be
performed. They include:

-@[+]<file> - check of objects listed in the given file, the + (plus)
symbol instructs not to delete a file from the list of objects after
the check is completed; the list file may contain paths to directories
scanned periodically, or a list of files to be checked regular only;

-sd - recursive search and testing of files in subdirectories starting
with the current one;

-fl - follow the references, both for files and directories; the
references resulting in "circularity" are ignored.


The diagnostics options determining what types of objects should be
checked for viruses include:

-al - the diagnostics of all files on the specified drive or in the
directory specified as an argument;

-ar[d|m|r][n] - check of files in archives (ARJ, CAB, GZIP, RAR, TAR,
ZIP); additional options instruct: d - delete, m - move, r - rename
archives, containing infected objects; n option disables displaying
the names of the archiving tools; by archives we mean not the archives
themselves (e.g., such as *.tar), but also their compressed forms (in
particular, compressed tar-archives such as *.tar.gz and *.tgz);

-cn[d|m|r][n] - check of files in containers (HTML, RTF,
PowerPoint,..); d - delete, m - move, r - rename containers with
infected objects; n option disables displaying the type of the
container;

-ml[d|m|r][n] - check mail files; d - delete, m - move, r - rename
infected mail files, containing infected objects; n option disables
displaying the type of the mail files;

-upn - option disables displaying compression utilities names;

-ex - diagnostics of files the name of which correspond to specified
masks (see the FilesTypes option of the configuration file, section
3.4);

-ha - heuristic analysis of files, search of unknown viruses.


The actions options determine what actions should be performed if
infected (or suspicious) files are detected. They include:

-cu[d|m|r] - curing of infected files; additional options instruct:
d - delete, m - move, r - rename incurable files;

-ic[d|m|r] - determines actions for incurable files: d - delete,
m - move, r - rename incurable files;

-sp[d|m|r] - determines actions for suspicious files: d - delete,
m - move, r - rename suspicious files;

-adw[d|m|r|i] - specifies actions for files containing adwares:
d - delete, m - move to, r - rename such files, i - ignore;

-dls[d|m|r|i] - specifies actions for files containing dialer programs: 
d - delete, m - move, r - rename such files, i - ignore;

-jok[d|m|r|i] - specifies actions for files containing joke-programs:
d - delete, m - move to, r - rename such files, i - ignore;

-rsk[d|m|r|i] - specifies actions for files containing potentially
dangerous programs: d - delete, m - move to, r - rename such files,
i - ignore;

-hck[d|m|r|i] - specifies actions for files with hacktools: 
d - delete, m - move to, r - rename such files, i - ignore.

The interface options determine conditions of the programs report
output and include:

-ot - output information to stdout, i.e. a standard output;

-oq - disable information output;

-ok - display 'Ok' for non-infected files;

-log=<file> - logging to the specified file;

-ini=<file> - using alternative ini-file;

-lng=<file> - using alternative language file; if English interface is
chosen during the installation specify ru_scanner.dwl as such file to
display messages in Russian.


Some options disable the correspondent action if postfixed by the -
(minus) symbol. They include:

  -ar -cu -ha -ic -fl -ml -ok -sd -sp

Example, if starting the scanner as 
  drweb -path=<path> -ha-

the heuristic check of files for viruses, usually enabled by default,
will be disabled.

By default (with no options specified), if the program was not
reconfigured (this will be described in the next section), the scanner
will be started with the following options:

  -ar -al -ha -fl- -ml -sd

This set of the default scanner options (including the scanning of
archives, packed files, mail programs, recursive search, heuristic
analysis, etc.) is rather expedient for the diagnostics and can be
applied in most standard cases. If the definite situation does not
require applying some default option it can be disabled by placing the
- (minus) symbols after it, as it was described above with the -ha
(heuristic analysis) option.

Disabling the archived and packed files check significantly decreases
the antivirus protection level, as the archives (often self-unpacking)
distribute file viruses enclosed in mail attachments. The documents of
certain applications, potentially susceptible to infection with macro
viruses (Word, Excel), are also usually sent via e-mail being archived
and packed.

When starting the scanner with the default options no curing of the
infected files is provided. Nor any actions for incurable and
suspicious files are taken. Such actions require specifying additional
command line options - actions options.

The set of the actions options may vary in each case. Still, we
recommend the following:

-cu - curing of infected files and system areas, without
   deletion, moving or renaming the infected files;

-icd - deletion of incurable files;

-spm - moving or -spr - renaming of suspicious files.

When starting the scanner with the cure option, the program will make
an attempt to restore the state of the infected object before the
infection with a virus. This action is possible only if the known
virus is detected, and the necessary instructions for curing are
available in the base; still, even in these cases the attempt of
curing may fail, for example, if the infected file has already been
seriously damaged by the virus.

If the infected files were found inside the archives, they will not be
cured, deleted, moved or renamed. To have the viruses deleted from
such objects the archives should be manually unpacked by the
correspondent software tools, advisably into a separate directory,
which will be specified as an argument at the next scanner start.

If started with the delete option, the program will delete the
infected file on the disk. This option is advisable for incurable
(irreversibly damaged by a virus) files.

The rename option instructs to replace the file extension name with
some specified extension (by default it is *.#??, i.e. the first
extension symbol is replaced with #). Enable this option for files of
other operating systems (e.g., DOS/Windows) detected heuristically as
suspicious. Renaming will exclude the accidental launch of executable
modules in these systems, loading of Word or Excel documents till the
next check and avert the infection by a possible virus and its further
proliferation.

The move option enabled will move the infected (or suspicious for a
virus) file to the specified directory (by default,
/var/drweb/infected). By now, it is of theoretical value only:
it is useless for files of other operating systems, as they cannot
damage a host system. Moving suspicious files in the Unix-system
itself may produce operational errors and even result in its total
failure.

The advisable mode of the scanner start for everyday usage will be as
follows:

> drweb -path=<path> -cu -icd -spm -ar -al -ha -fl- -ml -sd

Such a command can be saved as text file, which, with the help of the
following command
  chmod a+x [name] 
can be interpreted as a command shell script, or as a script for
different situations. However, the default options sets can also be
changed when setting the scanner. For details read the next section.


3.4. Configuring the scanner

You can certainly use the scanner with its default settings, but it is
much more convenient to adjust it according to you requirements and
conditions of operation. The scanner settings are stored in the
program's configuration file, by default it is drweb32.ini and located
in the /usr/local/etc/drweb directory. To use another configuration file
specify the full path to it by the command line key at the scanner
start, e.g.:

> $ /usr/local/sbin/drweb -ini=/usr/local/etc/drweb.ini

The configuration file is a text file (can be edited by any text
editor) that has the following arrangement:

--- Beginning of file ---
[Name of section 1]
Parameter1 = value1, ..., valueK
.....
ParameterM = value1, ..., valueK

......

[Name of section X]
Parameter1 = value1, ..., valueK
.....
ParameterY = value1, ..., valueK
--- end of file ---

If the line begins with ";" or "#", it is considered a line of
comments; such lines are skipped by the scanner when reading
parameters from the ini-file.

If some parameter of the scanner is not specified, this does not mean
the parameter has no value, - the default value will be used (a common
mistake when setting the scanner up). Only some parameters are
optional or have no default values, which will be specially mentioned
below. The values can be included in brackets (they must be included
in brackets if contain blanks). Some parameters can have several
values, the "," (comma) plays the role of the separator; in the
parameter description it will be explicitly stated. If the values are
included in {} in the parameter value field in this description, it
means the parameter may take only one of these values.

Scanner settings section name - [Scanner].

The parameters will be described as follows:

ParameterName = ParameterPseudoValue
        Parameter description
        May have or not several values
        Default value: 
                {value | unspecified}

Parameters description in their sequence order in the configuration
file created when setting up the program.

EnginePath = {path to a file, usual extension is dll}
        The location of the drweb32.dll module (search module). This
        parameter is also used by the updating module for updating the
        search module.
        Default value: 
                /usr/local/drweb/lib/drweb32.dll

VirusBase = {list of paths (masks) to files, usual extension is vdb}
        Masks for loaded virus bases. This parameter is also used by
        the updating module for updating the antivirus bases. Listing
        of several masks allowable.
        Default value: 
                /var/drweb/bases

UpdatePath = {directory}
        This parameter is used by the updating module (update.pl) and
        if used, it should be obligatory specified.
        Default value: 
                unspecified

TempPath = {directory}
        This directory is used by the antivirus module (search engine)
        to create temporary files. At normal operation this directory
        is almost not used, it is used for unpacking certain archives,
        or when a system lacks memory resources.
        Default value: 
                empty (used /tmp)

LngFileName = {path to the language resource file, usual extension - dwl}
        Location of the localization file.
        Default value: 
                empty (in this case the messages are displayed in English)

Key = {path to a file, usual extension is key}
        Location of the key file (license or demo).
        Default value: 
                /usr/local/drweb/drweb32.key

OutputMode = {Terminal | Quiet}
        Information output mode at start: Terminal outputs to a
        console, Quiet disables output.
        Default value: 
                Terminal

HeuristicAnalysis = {Yes | No}
        Enabling/disabling the heuristic detection of unknown viruses.
        Enabling the heuristic analysis makes possible detection of
        unknown viruses on the basis of a priori assumptions of the
        virus code structure. The approximate, probabilistic nature of
        this type of the virus detection, we'd rather speak about
        suspicious, than infected objects, distinguishes this type of
        the virus search. With this option disabled only known viruses
        will be detected by the virus base. A whole class of programs
        using similar with viruses code can cause an erroneous
        triggering of the heuristic analyser. Besides, this mode may
        somewhat increase the time of scanning for viruses (still,
        this increase is insignificant). These considerations may
        serves as reasons for disabling the heuristic analysis. At the
        same time, the analysis improves the reliability of the
        antivirus protection. We would advise to send all files
        detected by the heuristic analyser to developers through
        http://www.drweb.com (preferably) or via e-mail
        newvirus@drweb.com. Follow this procedure to upload the file.
        Archive the file in a password protected archive, include the
        password in the message body and attach the scanner report.
        Default value: 
                No

ScanPriority = {value}
        The daemon's scanning processes priority. The range of this
        parameter value should be within -20 (highest priority) to 20
        (lowest priority).
        Default value: 
                0

FilesTypes = {list of extensions}
        The types of files to be checked "by type", i.e. when the
        ScanFiles parameter (explained below) has the ByType value.
        The symbols "*" and "?" are allowable. Several lines are
        allowable for such parameter name; in this case the specified
        lists are summed up.
        Default value: 
                EXE, COM, SYS, OV?, BAT, BIN, DRV, PRG, BOO, SCR, CMD,
                VXD, 386, DLL, FON, DO?, XL?, WIZ, RTF, CL*, HT*, VB*,
                JS*, INF, AR?, ZIP, R??, PP?, OBJ, LIB, HLP, MD?, INI,
                MBR, IMG, CSC, CPL, MBP, SHS, SHB, PIF, SO, CHM, REG,
                XML, PRC, ASP, LSP, MSO, OBD, THE*, NWS, SWF, BMP,
                MPP, OCX, DVB, CPY, MSG, EML

ScanFiles = {All | ByType }
        Additional restriction for files to be checked. With the
        ByType value set the so-called file extensions (i.e. the last
        suffix after "." in the filename, if "." is absent it means
        the file has no extension), the values of which are specified
        or set either by default, or in the FilesTypes parameter
        (parameters), are taken into account.
        Default value:
                All

ScanSubDirectories = {Yes | No}
        Whether or not the scanner should check the content of all
        subdirectories in all the directories specified in the scanner
        command.
        Default value: 
                Yes

CheckArchives = {Yes | No}
        Whether or not ZIP (WinZip, InfoZIP...), RAR, ARJ, TAR, GZIP
        and CAB archives should be unpacked.
        Default value: 
                Yes

CheckEMailFiles = {Yes | No}
        Whether or not the files of (e-mail) formats should be checked.
        Default value: 
                Yes

ExcludePaths = {list of paths (masks) to be excluded from search}
        The masks for files that should not be checked.
        Default value: 
                empty

FollowLinks = {Yes | No}
        Whether or not the symbolic link should be followed at scanning.
        Default value: 
                No

RenameFilesTo = {mask}
        Masks for renaming files, if for the definite condition (an
        infected or suspicious file) the Rename action is set.
        Default value: 
                "#??" means that the first character of the file
                "extension" will be replaced with "#", and two
                subsequent characters will be preserved. If a file had
                no "extension", it will consist of just one "#"
                symbol.

EnableDeleteArchiveAction = {Yes | No}
        This option enables/disables the scanner's Delete (deletion)
        action for various complex objects (archives, mailboxes,
        html-pages), if they contain an infected object.
        WARNING. With this option enabled the whole complex object will
        be deleted, i.e. the whole archive, or the whole mailbox, not
        only the infected message or a file in the archive. Apply this
        option carefully!
        Default value:
                No

InfectedFiles = {reaction}
        Sets the program's reaction for detection of a file infected
        with a known virus. Allowable parameter values inlude:
        Report - report information to log only;
        Cure - try to cure an object;
        Delete - delete an infected file;
        Move - move a file to the directory specified by the
                MoveFilesTo parameter;
        Rename - rename a file using the masks specified by the
                RenameFilesTo parameter.
        Default value:
                Report

        NOTE. The delete, move and rename actions set for the infected
        objects detected in archives, containers and mailboxes are
        applied to the whole archive, container or a mailbox.

Some other similar parameters setting the program's reaction on
detection of one or another object are also supported:

SuspiciousFiles - a file probably infected by an unknown virus;

IncurableFiles - a file is infected and incurable (makes sense only
        if InfectedFiles = Cure);

ActionInfectedMail - a message or a mailbox contain an
        infected object;

ActionInfectedArchive - an archive (ZIP, TAR, RAR and other)
        contains an infected file;

ActionInfectedContainer - a container (OLE, HTML, PowerPoint and
        other) contains an infected file.

        For all these parameters the same values as for the
        InfectedFiles parameter, except for Cure, can be specified.

        Default value for each parameter:
                Report

There also available some more similar action parameters:

ActionAdware - a file contains a program for displaying advertisements
        (so-called AdWare);

ActionDialers - a file contains an automatic dialer program, usually
        used by porno-sites;

ActionJokes - a file contains a joke program, which can frighten or
        irritate user;
 
ActionRiskware - a file contains a dangerous program, which can be used
        by malefactors;

ActionHacktools - a file contains a hacktool for breaking into computers
        and other computer techniques.

        For al these parameters the same values as for the InfectedFiles
        parameter, except for Cure, can be specified. In addition to
        these actions, Ignore is also avaliable, in console version this 
	action is analogues to Report except an exit code does not contains
	an information about such objects, it is also used by the scanner 
	graphical shell.
        Default value for each parameter:
                Report

LogFileName = {filename}
        Log filename. You may specify "syslog" for the log filename
        and the logging will be done by means of the syslogd system
        service. When using syslog the SyslogFacility and
        SyslogPriority parameters (explained below) should be taken
        into account. As syslog utilizes several files for logging
        different events and different degrees of their importance,
        these two parameters and the content of the syslog
        configuration file (usually /etc/syslogd.conf) determine the
        location where the report will be logged to.
        Default value: 
                syslog

SyslogFacility = {Daemon | Local0 .. Local7 | Kern | User | Mail}
        Sets the log type when using syslogd system service.
        Default value: 
                User

SyslogPriority = {Alert | Warning | Notice | Info | Error}
        Sets the log priority when using syslogd system service.
        Default value: 
                Info

LimitLog = {Yes | No}
        The parameter defines whether or not the log file size should
        be limited.
        Default value: 
                No

MaxLogSize = {value in Kb}
        This parameter sets the maximum log file size. Can be used
        with LimitLog = Yes only.
        Default value: 
                512

LogScanned = {Yes | No}
        Whether or not the information on all scanned objects,
        regardless the viruses were detected or not, should be logged.
        Default value: 
                No

LogPacked = {Yes | No}
        Whether or not additional information on files packed with
        DIET, PKLITE, etc. utilities should be logged.
        Default value: 
                Yes

LogArchived = {Yes | No}
        Whether or not additional information on the archiving tools
        should be logged.
        Default value: 
                Yes

LogTime = {Yes | No}
        Whether or not the time for each record should be logged. The
        parameter is not used if LogFileName is set to "syslog".
        Default value: 
                Yes

LogStatistics = {Yes | No}
        Whether or not the total statistics of scanning should be logged.
        Default value: 
                Yes

RecodeNonprintable = {Yes | No}
        The output mode for symbols invisible for the given terminal.
        Default value: 
                Yes

RecodeMode = {Replace | QuotedPrintable}
        The RecodeNonprintable value set to "Yes" specifies decoding
        for invisible symbols. If the value is set to "Replace", all
        such symbols are replaced with the RecodeChar parameter value
        (see below).
        Default value: 
                Replace

RecodeChar = {"?" | "_" | ...}
        The RecodeMode value set to "Replace" specifies the symbol the
        invisible symbols will be replaced with.
        Default value: 
                "_"

The following parameters can be used to reduce the archives' scan time
(some objects in the archive will not be checked).

MaxCompressionRatio = {value}
        Maximum compression ratio, i.e. the ratio of the unpacked file
        size to the packed file size (inside an archive). If the ratio
        exceeds this value the file will not be extracted, and
        therefore will not be checked.
        Default value: 
                empty (all files are checked)

CompressionCheckThreshold = {value in Kb}
        The minimum size of a file inside an archive beginning from
        which the compression ratio check will be performed (if this
        is specified by the MaxCompressionRatio parameter).
        Default value: 
                empty (the ratio check is not performed)

MaxFileSizeToExtract = {value in Kb}
        The maximum size of a file extracted from an archive. If the
        file size inside the archive exceeds this value it will be
        skipped.
        Default value: 
                empty (the files of any size get extracted)

MaxArchiveLevel = {value}
        The maximum archive nesting level (archive in archive, then in
        archive, etc.)
        Default value: 
                empty (archives of any nesting level get extracted)



                         4. CONTACTS

Dr.Web program gets constantly developed, for fresh updating
information and news please visit our site:
http://www.drweb.com

Marketing dept.:
http://buy.drweb.com
e-mail: sales@drweb.com

Support:
http://support.drweb.com
E-Mail: support@drweb.com

Please include following information in your problem report:

- full name and version of your unix distribution
- Dr.Web version that is logged during program start.
