VirusScan Command Line search for viruses

[Hangar0]

VirusScan Command Line is a program that you can run from a command-line prompt. It provides an alternative to scanners that use a graphical user interface (GUI). Both the scanners use the same scanning engine. VirusScan Command Line enables you to search for viruses in any directory or file in your computer on demand.
https://kc.mcafee.com/corporate/index?p ... cale=en_US
https://kc.mcafee.com/corporate/index?p ... cale=en_US
.
VSCL 6.1.2 Product Guide https://docs.mcafee.com/bundle/virussca ... D28135.pdf
page 9. We (mcafee) distribute the VirusScan Command Line software in two ways — on a CD, and as an archived file that you can download from our website or from other electronic services.
page 12. To remove the product from your system:
1- Change your command prompt to point to the directory that contains the VirusScan Command Line files.
2- Delete all files in the directory.
.
How to run Command Line Scanner.
https://kc.mcafee.com/corporate/index?p ... cale=en_HK
Obtain the VCLS from the Product Downloads site, for example: vscl-w32-6.0.x-l.zip
vscl-w32-613-e.zip 3.4M EVALUATION (new)
http://b2b-download.mcafee.com/products ... -613-e.zip
vscl-w32-606-l.zip 2.4M LICENSED (old, 07-Aug-2015)(vscl-w32-613-l.zip LICENSED)
http://downloadcenter.mcafee.com/produc ... -606-l.zip
Create a temporary folder under the root of the C: drive and name it C:\Scan.
Extract the files to the Scan folder.
.
Obtain the .DAT file, Download the AVV-DATnnnn.zip package, where nnnn is the version number, from one of the McAfee Common Updater sites:
https://download.nai.com/products/commo ... /dat/0000/
avvdat-9540.zip 23-Feb-2020 15:02 132M
After the .zip file has downloaded, extract the contents and copy them to the VSCL installation directory. The the existing files are replaced.
The next time the VSCL runs, it uses the new DATs.
.
Extract the downloaded files:
Extract vscl-w32-6.0.x-l.zip to C:\Scan.
Extract avvwin_netware_betadat.zip to C:\Scan.
Click Replace all to replace the old DAT files with the new ones.
.
Create a batch file to more easily run the Command Line Scan with the needed switches:
Start Notepad and copy the following command to a new file:
C:\Scan\SCAN.EXE /clean /all /adl /program /unzip /winmem /analyze /extra C:\extra.dat /report C:\EDreport.txt /rpterr
Save the batch file under C:\ as Scan.BAT
.
Scan %* /NC /NOEXPIRE /SUB /SECURE
.
Display a list of command-line options SCAN /?
.

.

[Midas]

Thanks for the detailed write up, Hangar0.

Now that my ClamWin cum Sentinel setup is getting sorely obsolete, I'll have to study alternatives and VirusScan (which, believe or not, was the first I used at the dawn of my computing experience ) looks like it could fit the bill.

[Hangar0]

new dat file .
avvdat-9778.zip 18-Oct-2020 07:54 143M

[Hangar0]

new update mcscan32.dll
AV Engine version: 6500.9779 for Win
... ... ... ... mcscan32.dll
... ... ... ... config.dat
https://download.nai.com/products/commo ... gine/0000/
engmin.zip 05-Jun-2023 12:43 2.7M
engmin64.zip 05-Jun-2023 12:43 3.0M
After the .zip file has downloaded, extract the contents and copy them to the VSCL installation directory. The existing files are replaced.
The next time the VSCL runs, it uses the new AV Engine
Click Replace all to replace the old files with the new ones.
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
Obtain the new .DAT file
Download the AVV-DATnnnn.zip package
.. where nnnn is the version number, from one of the McAfee Common Updater sites:
https://download.nai.com/products/commo ... /dat/0000/
avvdat-10732.zip 05-Jun-2023 12:43 138M
After the .zip file has downloaded, extract the contents and copy them to the VSCL installation directory. The existing files are replaced.
The next time the VSCL runs, it uses the new DATs.
Click Replace all to replace the old files with the new ones.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
to the VSCL installation directory...
This will generate a file called runtime.dat
CMD:
scan.exe /DECOMPRESS
.- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Midas]

Is there a free source for the McAfee VirusScan console scanner? Where and which version is it?

I found various archive files scattered online (apparently, the latest VirusScan release is v8.8[?]) but couldn't figure which one to download to start from scratch -- and the ones that I did had no 'scan.exe' file in them...

[Hangar0]

greetings midas
-----------------------------------------------------------------------------------------------
from "message 1" free with license
vscl-w32-606-l.zip 2.4M LICENSED (old, 07-Aug-2015)(vscl-w32-613-l.zip LICENSED)
http://downloadcenter.mcafee.com/produc ... -606-l.zip
... scan.exe (version 6.0.6.653) ... 871KB
... license.dat ... 1KB
It's very old but still valid, I've been using it with no problem for years (in WXP/7/8 32b).
-----------------------------------------------------------------------------------------------
.. in the directory containing the executable (scan.exe), extract the files from "message 4" there.
... engmin.zip (AV Engine)
... avvdat-10732.zip (.DAT file)
-----------------------------------------------------------------------------------------------
.. the directory .. that's how it should look :
scan.exe
avvclean.dat
avvnames.dat
avvscan.dat
config.dat
license.dat
runtime.dat
mcscan32.dll
-----------------------------------------------------------------------------------------------
... example scan file..
scan.exe /NOEXPIRE /SECURE /LOUD /noboot /nomem /norecall /norename /RPTALL /REPORT=Report-Mcafee.tmp "Scan-object"
... file eicar to verify operation zip
https://www.virusanalyst.com/eicar.zip

[Hangar0]

... ..oops.. the link looks like this now "download.nai.com"
vscl-w32-606-l.zip 07-Aug-2015 10:03 2.4M
https://download.nai.com/products/mcafe ... -606-l.zip
...
.. my mistake .. I don't know when it was renamed
at some point I was just redirected

[Hangar0]

now McAfee is Trellix ?
https://en.wikipedia.org/wiki/Trellix

https://kcm.trellix.com/corporate/index ... id=KB94726
Supported platforms for Command Line Scanner 7.x
of the article ...
Anti-Malware Scan Engine 6.6.00 (6600), 6.5.00 (6500), 6.4.00 (6400), 6.3.00 (6300)
Command Line Scanner (CLS) 7.x
The CLS provides an alternative to scanners that use a graphical user interface (GUI).
NOTE: You need a valid Grant Number for access. (does not give free access to the public; There are two license and evaluation)
..


"Anti-Malware Scan Engine" (mcscan32.dll v6.500.0.9779) according to the article "CLS v6.0.6" (scan.exe v6.0.6.653) should not support it but it works well.



sample of malware under test; test done by me
theZoo - A Live Malware Repository; Be careful
https://github.com/ytisf/theZoo/tree/ma ... RAT-v0.6.4
"njRAT-v0.6.4.zip" unzipped and parsed




https://kcm.trellix.com/corporate/index ... cale=en_US
FAQs for Anti-Malware Scan Engine 6.x.xx
This article is a list of common questions and answers.

[Midas]

Finally got it to work...

Code: Select all

McAfee VirusScan Command Line for Win32 Version: 6.0.6.653
Copyright (C) 2015 McAfee, Inc.
(408) 988-3832 LICENSED COPY - junho 22 2023

AV Engine version: 6600.9927 for Win32.
Dat set version: 10749 created Jun 22 2023
Scanning for 596816 viruses, trojans and variants.

Steps followed:

1. Downloaded vscan program:
   download.nai.com/products/mcafee-avert/vscl-w32-606-l.zip;
2. Downloaded program engine ('engmin.zip' & 'engmin64.zip') from:
   download.nai.com/products/commonupdater/current/vscaneng1000/engine/0000/
3. Downloaded latest virus information database:
   (currently 140MB 'avvdat-10749.zip', released 2023-06-23)
   download.nai.com/products/commonupdater/current/vscandat1000/dat/0000/
4. Extracted everything to some folder
5. Open CLI, navigate to folder and, e.g., run...

   Code: Select all

   > vscan /version

Final question: is it possible to get a 64-bit version by any means?

[Hangar0]

hi midas..
64b V .... I'm sorry, I don't have the link
I don't have the "clean link" .. the one licensed shared by the same company..
.. but if I find it I will share it of course.
.. VSCL-v702-(32-64b) It's out there somewhere, if you want to try ..
600613["taiwebs mcafee command line scanner"]
I try not to go overboard, if I did please censor the comment

[Midas]

Roger. Didn't mean those means... but thanks.

[Hangar0]

New DAT file
https://download.nai.com/products/commo ... -10832.zip
avvdat-10832.zip 13-Sep-2023 11:47 155M