SAV32cli im abgesicherten Modus - nur Quick Scan - keine Auswahl

Hi Lothar Peters 

Please refer to the below-mentioned KB articles regarding SAV32CLI.exe which will help you in your query.

• SAV32CLI, the command line version of Sophos Anti-Virus on Windows​
• Sophos Endpoint Security and Control: How to remove malicious files with SAV32CLI​​
• Sophos Endpoint Security and Control: Scanning options with SAV32CLI​

So: Gelöst - by Myself

Btw: Ich erhielt eine Antwort von "Jasmin" - ist die/dass ein "Bot" ???

Die Frage stellt sich mir, weil ich auch in englischen Foren Antworten von "Jasmin" bekam.

- Jedesmal Verweise auf Seiten, die ich schon X-Mal besucht habe....

Wie auch Immer:

Meine Eingabe in der Konsole ist wie folgt:

"C:\Programme\Sophos\Sophos Anti-Virus\sav32cli.exe" -all -sc -c -b -remove -dn -f -di -did -dipe -sc -removef -dn -mime -cmz -noc -archive -cab -gzip -P=C:\LOGFILE.TXT

- und schon rennt die Kiste

Danke fürs Lesen

Hi Lothar Peters 

Thank you for sharing the command line.

Fortunately, I am a human being and Sophos Staff.

Hello Jasmin,

Sorry for the title "Bot".  

Because, you sent me links to SAv32CLI a few times.  

I visited them long time ago - a few times. 

I never found a useful discription in there. 

Therefore, i surched and tried by myself. 

Kind Regards

Lothar Peters

Hi Lothar Peters 

That's all right. Please let us know if you need any other help.

Yes Jasmin - there is one thing left, which i don't know about - resp: I don' know / can't find commands, which i need (maybe).  

If you take a look at my comands in the line, maybe there is something missing.  

In the Tool from David Lipman, there was the queation integrated about:

" Do you wanna surch a particular drive: Yes or No"

Now, i am not shure about the actual SAV32CLI.  

In the discription (list) of the possible commands, there was nothing about scanning surtend drives.

Because, i have a dual installed system (first = Win 7 Ultimate / second = XP Professional)

I am not shure about my commands - scanning all drives.  

Btw: Sophos is installed on C = Win 7 Ultimate

Kind Regards

Lothar Peters

Hi Lothar Peters 

Thank you for this question because of which I got very the release notes of the sav32cli tool.

I am sure this will be very useful to you. There they mentioned for the scanning of specific drive and also one of the above mentioned KBs also have that information.

Hello Lothar Peters  and I'm not a bot Jasmin,

while the release notes are quite outdated re version numbers and interaction with "the GUI" (guess there are only a few still alive that remember this GUI and its looks) they are as far as I can tell pretty complete and accurate w.r.t. arguments and switches.
Note under Operation/Filename extensions: By default, SAV32CLI will scan all local hard drives recursively ..., and its response to sav32cli.exe -h:
Usage: sweep [options] <path1> <path2>... <pathN> [include/exclude options]

where <path1>, <path2>... <pathN> may refer to files, directories or filesystems.

Thus to scan drive E: you'd simply put E: somewhere on the commandline.
BTW: The command you've shown uses some arcane and undocumented switches. Where did you find them? -did and -didpe are likely redundant when -di is used, not sure what -removef does. From its position in the executable -noc might be a synonym of -nc and thus the negation of -c (that asks for confirmation before disinfection/deletion). If so, then it overrides the -c (which is anyway the default) specified earlier.

Christian

Hello Christian,

thank you for your response.

The commands, i found / copied from the tool:  "Multi AV" from David Lipman.

Allso, i found out, that many of these commands are not listed in the menu from SAV32CLI.exe.

I just run it - and deleted all the commands, which where not supported.

About all drives:

Do i have to use additional the command:  "-h"  ? - to run all drives?

- or does the scanner do that anyway? - with or without "-h"  ?

About local drives:

The scanner is running on C (Win 7 Ultimate)

I would like to scan ALL drives on my dual installed system.

It's C (Win 7)   E (XP)  and D

But not only this local drives - i would like to scan ALL drives, which are connected to the PC.

Years ago, i run Multi AV from David Lipman - when the tool script is / was running - when i run Sophos,

there was the question about:  "Do you want to run a specific drive - Yes or No"

When i chose for No - the integrated sophos scanner run / scanned All drives - including Network - USB, LAN ect.

Kind Regards

Lothar Peters 

Hi Lothar Peters and QC 

I am not aware about the David Lipman tool and how it worked previously.

AFAIK, SAV32CLI.exe can scan the network mapped drive but you need to mention that drive letter or say need to run scan individually for those drives.

I am not sure whether -all can scan all local and network mapped drives or not but QC can definitely suggest you on this. Also, you can try by mentioning all the drive letters in the scan command which may work.