    Antivirus program Doctor Web for Linux, FreeBSD and Solaris
                         Version 4.28

             Copyright (c) 1992-2002, Igor Daniloff
    Igor Daniloff's antivirus laboratory, DialogueScience, Inc.
                                                               
                     DrWeb Daemon for Unix
                  System administrator manual


1. What is DrWeb Daemon for Unix ?
2. Setting up DrWeb Daemon
3. About the keys (key files)
4. Launching DrWeb Daemon
5. Verifying DrWeb Daemon operability
6. Checking modes realized by DrWeb Daemon (local scanning)
7. DrWeb Daemon program API
  7.1. Program API
  7.2. Use libdwclient.a library
8. Contacts


                1. What is DrWeb Daemon for Unix ?

DrWeb Daemon is an antivirus daemon, that in point of fact is an improved
antivirus scanner. But in contrast to the scanner loading bases and the
scanning module at every new start, the daemon loads these components
only once, when starting, and is always ready in the memory awaiting the
next scanning task. Besides, the daemon can carry out a few scans
simultaneously which provides on average faster response. In other respects
DrWeb Daemon has the same facilities as the other products of the DrWeb
family:

- it uses the kernel and the virus base used by all the other scanners of
the family;
- detects and cures all the known viruses; 
- performs scanning of packed files and archives.
Besides, recently the option of mail filtering based on header analyzing
has been added in DrWeb Daemon.

The fact that the daemon is always ready to function and has a comprehensible
and accessible protocol for scanning requests makes it a suitable
component for creating antivirus filters for mail systems and file servers.
Developers of DrWeb suggest the ready solutions on integration DrWeb Daemon
with CommuniGatePro, Sendmail, Postfix, Exim, QMail and Zmailer mail
systems, and also the solution on integrating with Samba file servers.
There may obviously be other fields of application of DrWeb Daemon,
although the listed ones are by now the principal ones.


                2. Setting up DrWeb Daemon

Naturally, you can run the daemon with the default settings, but it is
better to set it so that it would conform to your requirements and
conditions of utilization. The file drweb32.ini gets read by DrWeb Daemon
from the directory /etc/drweb. To use another configuration file you should
specify the full path to it in the command line key when starting DrWeb
Daemon, e.g.:

$ /opt/drweb/drwebd -ini:/opt/drweb/drwebd.ini

The configuration file drweb32.ini is a text file (so you can edit it in
your favorite text editor) organized in the following way:

--- beginning of the file ---
[Section 1 name]
Parameter1 = value1, ..., valueK
.....
ParameterM = value1, ..., valueK

.....

[Section X name]
Parameter1 = value1, ..., valueK
.....
ParameterY = value1, ..., valueK
--- end of the file ---

The ";" character (semicolon) at the beginning of the line marks a commented
line skipped by DrWeb Daemon when reading the parameters from the .ini file.

It is extremely important to note that if a parameter determining DrWeb 
Daemon is not set, it does not mean it has no value, it means that the 
default value will be applied (a common mistake coming along with the 
procedure of setting). Only few parameters are optional or have no default 
values, which will be specially indicated below. The values may be put 
in quotes (and should be put in quotes if they contain blanks). Some 
parameters may have a few values separated by "," (comma), it will be 
clearly indicated in the description of the parameter. If values are 
enclosed into {} in the parameter value field description, the parameter 
can take only one of them.

In the section name are indicated: the platform (scanner section); DrWeb
Daemon parameter section also contains Daemon suffix. E.g.:

[Linux:Daemon]
; DrWeb Daemon for Linux parameter section
[Linux]
; Scanner for Linux parameter section
[BSD:Daemon]
; DrWeb Daemon for FreeBSD parameter section
etc.

The description of the parameters will go as follows:

ParameterName = ParameterPseudoValue
        Description of the parameter
        {Whether it can have a few values}
        Default value: { value | absent }

Parameters common for the daemon and the scanner:

EnginePath = { path to the file, usual extension is dll }
        Location of drweb32.dll module (search module). This parameter is
        also used by the updating module to update the search module. You
        may specify relational path, but it is strongly recommended to make
        it absolute.
        Default value:
                "/opt/drweb/lib/drweb32.dll"

VirusBase = { list of the paths (masks) to the files, usual extension is vdb }
        Masks for the loaded virus bases. This parameter is also used by
        the updating module to update antivirus' bases. A few masks can be
        enumerated.
        Default value:
                "/var/drweb/bases/*.vdb"

UpdatePath = directory
        The parameter is used by the program update module and
        is compulsory if the module is used.
        Default value: "/opt/drweb/updates"

Key = {path to the file, usual extension is key }
        Location of the file with the registration key. You may specify
        relational path, but it is strongly recommended to make it
        absolute.
        Default value:
                "/opt/drweb/drweb32.key"

LngFileName = { path to the language resource file, usual extension - dwl }
        Localization file location.
        Default value: absent (would be used English language)

CheckPackedFiles = { Yes | No }
        Should unpacking of the executable files packed by DIET, PKLITE
        etc. utilities be performed.
        Default value: Yes

CheckArchives =  { Yes | No }
        Should unpacking of the archives of ZIP (WinZip, InfoZIP...), RAR,
        ARJ, TAR, GZIP and CAB formats be performed.
        Default value: Yes

CheckEMailFiles = { Yes | No }
        Should files in e-mail formats get scanned.
        Default value: Yes

ScanPriority = { value }
        Priority of the scanning process. This value should be in the range
        -20 (highest) to 20 (lowest).
        Default value: 0

MaxFileSizeToExtract = { value in Kb }
        The maximum size of the file extracted from an archive. If the file
        in the archive exceeds the value it will be skipped. Note: a
        message with such a file will be treated as "mail bomb".
        Default value: absent (files of any size will be extracted)

MaxCompressionRatio = { value }
        Maximum compression ratio, i.e. ratio of the unpacked file length
        to the length of the packed file in the archive. If the ratio
        exceeds the value, the file will not be extracted and therefore
        will not be checked. Note: a message with such a file will be
        treated as "mail bomb".
        Default value: absent (compression ratio will be ingored)

ScanFiles = { All | ByType | ByFormat }
        The files that will get checked after having been extracted from
        the archive. If ByType is set the so called file extensions are
        taken into account (file extension is the last suffix after "." in
        the file name; if there is no ".", file has no extension). The file
        extension values are set either by default, or in the parameter(s)
        FilesTypes. If ByFormat is set, only the files included into the
        checkable set get checked. The aim of the check is to find out
        whether they can be virus carriers, i.e. executable files (file
        name and extension are not taken into account). And only then only
        presumably executable files will be scanned for viruses. Important
        note: the All mode is always enabled in the mail files. ByType and
        ByFormat values can be applied only in "local" scanning mode.
        Default value: All

FilesTypes = { extension list }
        Types of files that will get checked if by type scanning is
        performed, i.e. ScanFiles parameters has ByType value. "*" and "?"
        characters admissible.
        Default value:
                "EXE, COM, SYS, OV?, BAT, BIN, DRV, PRG, BOO, SCR, CMD, VXD"
                "386, DLL, FON, DO?, XL?, WIZ, RTF, CL*, HT*, VB*, JS*, INF"
                "AR?, ZIP, R??, PP?, OBJ, LIB, HLP, MD?, INI, MBR, IMG, CSC"
                "CPL, MBP, SH*, PIF, MSG, CHM, REG, XML, PRC, TBB, ASP"

HeuristicAnalysis = { Yes | No }
        Permits DrWeb Daemon clients to use heuristic analysis, with the
        help of which the unknown viruses can be detected judging by the
        comprehension of the structure of virus code. The distinctive
        feature of this type of scanning for viruses is the approximate,
        probabilistic detecting of the infected objects therefore called
        suspected, not infected. The parameter disabled, only the known viruses
        from the virus data base are searched. There exists an entire class
        of programs which may cause false alarms of the heuristics
        analyzer because they use the code similar to that used by viruses.
        Besides, enabling this type of checking may increase the total
        scanning time (although insignificantly). These are arguments for
        disabling heuristic analysis. But on the whole, this type of
        analysis noticeably increases the safety of antivirus protection.
        Default value: Yes

MoveFilesTo = { directory }
        The directory where the files will be moved to; they will be moved
        if Move action is specified for the given file type (for the
        scanner only).
        Default value:
                "/var/drweb/infected"

RenameFilesTo = { mask }
        The renaming file mask; if the Rename action is specified for the
        given file type (for the scanner only).
        Default value:
                "#??" (it means that the first letter of the file extension
                will be replaced by "#", and the other two preserved. If file
                has no extension, it will consist of one "#" character only)

FollowLinks = { Yes | No }
        Should the symbolic links be followed when scanning.
        Default value: No

LogFileName = { file name }
        Log file name. You may specify "syslog" as name, the report will be
        logged by means of syslogd system service. Using syslog, pay
        attention to SyslogFacility and SyslogPriority options. Since
        syslog has a few files to log different events and different degrees
        of their importance, you can find out where the daemon's report will
        be written to, basing on these two parameters and the contents of
        the configuration file syslog (usually /etc/syslogd.conf).
        Default value: "syslog"

SyslogFacility = { "Daemon" | "Local0" .. "Local7" | "Kern" | "User" | "Mail" }
        Logging type if syslogd system service is used.
        Default value: "Daemon"

SyslogPriority = { "Alert" | "Warning" | "Notice" | "Info" | "Error" }
        Logging priority if syslogd system service is used.
        Default value: "Alert"

OverwriteLog = { Yes | No }
        Should the log file be overwritten every time the daemon is
        started. The parameter has no meaning, if LogFileName is "syslog".
        Default value: No

LimitLog = { Yes | No }
        Should the log file size be limited. The parameter has no meaning,
        if LogFileName is "syslog".
        Default value: No

MaxLogSize = { value in Kb }
        Maximum log file size in kilobytes. If log file size exceeds the
        value it will be overwritten at the start of the daemon. The
        parameter has no meaning, if LogFileName is "syslog" or if LimitLog
        is No.
        Default value: 512

LogScanned = { Yes | No }
        Should the information on all the checked objects independently
        infected or not get logged in the log file.
        Default value: No

LogPacked = { Yes | No }
        Should the additional information on the files packed by the DIET,
        PKLITE etc. utilities get logged in the log file.
        Default value: Yes

LogArchived = { Yes | No }
        Should the additional information on the archiving programs get
        logged in the log file.
        Default value: Yes

LogTime = { Yes | No }
        Should the time of every record get logged. The parameter has no
        meaning if LogFileName is "syslog".
        Default value: No

OutputMode = { Terminal | Quiet }
        Mode of outputting information on the console, Quiet cancels
        outputting.
        Default value: Terminal

Below the settings that can be described only in DrWeb Daemon section are
described.

SocketMode = { TCP | Unix }
        Socket type. If it is TCP, you should pay attention to the
        following parameters: DaemonPort, SocketReuseAddr and Interfaces;
        if it is Unix, take note of the SocketFile and SocketAccess
        parameters.
        Default value: TCP

DaemonPort = { number (decimal) from 1 to 65535 }
        Port number, used when working with the TCP socket.
        Default value: 3000

Interfaces = { interfaces or IP addresses list }
        List of interfaces or IP addresses, at which (not from which) the
        daemon will receive requests. It means that if the host where DrWeb
        Daemon is installed has a few interfaces the access may be
        restricted by specifying the interface where the requests will be
        received. For example, if you specify localhost only, only local
        computer will be able to supply scanning requests (since local
        interface is accessible for local programs only). One more example:
        a computer with two front-end interfaces (e.g. 10.0.0.1 and
        192.168.0.1); if you set only 10.0.0.1, the daemon will be
        accessible only for the hosts which have access to the specified
        interface.
        Default value: localhost

SocketReuseAddr = { Yes | No }
        Should the flag SO_REUSEADDR be used when working with TCP sockets.
        This flag allows to "release" quickly the port used by the daemon,
        in general mode the port is "occupied" for about 2 minutes after.
        It is strongly recommended to use the flag.
        Default value: Yes

SocketFile = { path to the file }
        Unix socket, used if SocketMode parameter is Unix.
        Default value: "/var/drweb/run/drwebd.socket"

SocketAccess = { number (octal) }
        Rights to access Unix socket (value in octal notation).
        Default value: 0666.

PidFile = { path to file }
        File name where information on its PID and Unix socket (if
        SocketMode is Unix) or port number (if SocketMode is TCP) will be
        written when the daemon gets started.
        Default value:
               "/var/drweb/run/drwebd.pid"

BusyFile = { path to file }
        Daemon's busy file name: it is created by the scanning "copy" of
        the daemon if having been commanded and gets removed after
        transmitting the result of its execution. File name created by
        every "copy" of the daemon gets expanded with a point and ASCIIZ
        representation of PID (e.g., /var/drweb/run/drwebd.bsy.1234).
        Default value: absent (file does not get created)

SocketTimeout = { value, seconds }
        Time of reception/transmission of all the data via the socket
        (without considering file scanning time).
        Default value: 40

FileTimeout = { value, seconds }
        Maximum checking time of a file.
        Default value: 40

User = { user name }
        The user whose rights the daemon is run under. It is recommended to
        create in the system a special drweb user which will be used by the
        daemon and some filters in future. It is undesirable to use DrWeb
        Daemon with root rights although it requires much less setting
        (particularly in the case of Samba servers).
        Default value:
               absent (that means that the daemon will use the rights of the
               user which has started it)

UserID = { numeric ID }
GroupID = { numeric ID }
        Group and user ID. Daemon will work with their rights. The
        parameters get ignored if the User parameter is set.
        Default value: absent

MaxChildren = { number }
        The maximum number of simultaneously working "children" (scanning)
        processes. If the number of requests received by the daemon exceeds
        the set value, the additional number of MaxChildren connections
        gets established (in TCP - ESTABLISHED), but data does not get
        received from them, all the rest remain idle waiting for request
        approval (in TCP - SYN_SENT). Timeouts for this cases significantly
        differ and depend on the OS.
        Default value: 16

As we have already noted, DrWeb Daemon has embedded capacities of e-mail
filtering based on the system of e-mail messages header analysis. The
regulations of filtration are also set in drweb32.ini, they get checked
when being set, i.e. the first set rule will be checked first. The fact of
setting filter regulations DOES NOT mean they will be automatically
applied. To enable header analysis you should set the corresponding options
in the delivered filters or specify special flags if making home decisions
on the base of DrWeb Daemon. Regulation correspondence is searched until
the first suitable regulation is found and the action set by the regulation
is taken. If the message does not correspond to any regulation the Accept
action is taken (the policy of "the not-inhibited is permitted" is
applied).

FilterRule HeaderName "mask" { Accept | Reject }
        Describes a regulation of filtering by header analysis. The
        "HeaderName" field can take any values (for example, "Subject",
        naturally, there is no sense in setting the names that never occur
        in mail messages). "Mask" is a register-independent mask carrying
        out the analysis of the header value basing on regular expressions,
        correspondent to POSIX 1003.2 standard (e.g.,
        ".*make.*money.*fast.*"). The final field specifies what action is
        taken if the header corresponds to the mask: Accept - let through,
        Reject - do not let through.


                3. About the keys (key files)

In the DrWeb Daemon's distributive there is a demo key, the so called
Evaluation Key. If it is used DrWeb Daemon is restricted in the following:

- "traditional" archives (such as ZIP, RAR, TAR, GZIP & etc) do not get
checked, but it DOES NOT concern "pseudoarchives" (MAIL, HTML, UUE & etc) and
packed files (packed by DIET, PKLITE and other compressing programs);
- infected files do not get cured;
- in local scanning mode all the multipart-mime messages get evaluation
banner added.

The Key parameter is described in both sections because evaluation keys for
DrWeb Daemon and the scanner differ (the scanner has more restrictions).
Having purchased a license for DrWeb Daemon you will obtain a new key file
(usually it is drweb32.key) suitable both for the daemon and the scanner.
Now you should change settings in drweb32.ini. To link up the new key file
you should replace in both sections the value of the Key parameter by the
full path to drweb32.key file:

For example, "Key = /opt/drweb/drweb32.key".

Important note: the key file IS NOT a text file. It may not be edited in
any way, neither automatically nor converted by some programs. It often
happens that a too smart mail program converts the key file from DOS format
(with CR LF line ends (in hexadecimal notation 0D 0A) into UNIX format
(with LF line ends (in hexadecimal notation 0A)).

Here is one more example of problem cases when no key (neither the
evaluation one) is loaded. It is simple to find out whether the key file
has been loaded or not from the daemon's loading log file. In the adduced
example none of the keys has been loaded:

=== cut ===
Dr.Web daemon for Linux, version 4.27 (December 28, 2001)
Fri Feb  1 14:43:33 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:43:33 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:43:33 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:43:34 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:43:34 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:43:34 2002 Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 27860
Fri Feb  1 14:43:34 2002 Daemon is installed, TCP socket created on port 3000
=== cut ===

The words "... EVALUATION version ..." make it rather unclear because it
seems that the Evaluation key has been loaded although it is no so. When
the key gets loaded (if the console output is enabled) there should be (at
least) the following records in the log file: Key File: {path/to/file} and
Registration info. Here it is, how the loading with the Evaluation key
looks like:

=== cut ===
Dr.Web daemon for Linux, version 4.27 (December 28, 2001)
Fri Feb  1 14:45:26 2002 Key file: /opt/drweb/drwebd.key
Fri Feb  1 14:45:26 2002 Registration info:
Fri Feb  1 14:45:26 2002 0100000002
Fri Feb  1 14:45:26 2002 Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
Fri Feb  1 14:45:26 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:45:26 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:45:26 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 27860
Fri Feb  1 14:45:28 2002 Daemon is installed, TCP socket created on port 3000
=== cut ===

Loading of the daemon with the full-functional registration key looks like
the following:

=== cut ===
Dr.Web daemon for Linux, version 4.27 (December 28, 2001)
Fri Feb  1 14:50:03 2002 Key file: /opt/drweb/FILENAME.key
Fri Feb  1 14:50:03 2002 Registration info:
Fri Feb  1 14:50:03 2002 XXXXXXXXXX
Fri Feb  1 14:50:03 2002 USER OR COMPANY NAME
Fri Feb  1 14:50:03 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:50:03 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:50:03 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:50:04 2002 Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 27860
Fri Feb  1 14:50:04 2002 Daemon is installed, TCP socket created on port 3000
=== cut ===
    

                4. Launching DrWeb Daemon

When loading daemon does the following:

- searches and loads the configuration file; if the file was not found,
DrWeb Daemon terminates loading. Path to the configuration file may be
specified in launching parameters with the help of the key
-ini:{path/to/your/drweb32.ini} or default value may be used
(/etc/drweb/drweb32.ini). At launching some parameters get validated. If
parameter value turns out to be inadmissible, default value is taken;

- localization file gets loaded, if fixed. If it fails, messages in
English are used;

- log file is created. Note: the user under whose rights the daemon
operates, should have write access to the directory containing the log
file;

- key file gets loaded according to the path specified in drweb32.ini.
If the key is not found the daemon continues launching but it will operate
in a very restricted mode (packed file, electronic messages etc. do not get
checked);

- if the User parameter is set (or UserID) the daemon tries to change its
rights;

- search module gets loaded (drweb32.dll). If it is not found (errors in
configuration file) or damaged loading is terminated;

- then the bases with virus descriptions get loaded. Bases are searched
according to the paths set in the configuration file, loading order is
not fixed; if a base is damaged or absent loading will continue;

- the daemon "come untied" of the terminal, that is why the further
problems will not be output to the terminal, but only logged in the log
file;

- socket gets created. In case of TCP there may be more than one of them;
if any of them failed when creating loading continues. In case of UNIX
socket make sure that the user under whose rights the daemon is run has
write and read access to the directory containing the socket. The users
whose rights are used by integrating modules should have execution access
to the directory and write and read access to the socket file;

- then the so called pid file gets created. In this file information on the
descriptor of daemon process and transport addresses at which the daemon is
available is stored. Another extremely important note: the directory with
the pid file must be accessible for writing for the user under whose rights
the daemon is run, and so if you have the User parameter specified, you
should re-specify the pid file parameter also, because the default directory
/var/drweb/run may be not accessible for writing for users. If the creation 
of the pid file failed loading is terminated.


                5. Verifying DrWeb Daemon operability

If no problems occurred when loading it will result in the ready-to-work
daemon - i.e. a fixed number of the scanners always ready to operate. You
can check whether the socket has been created by giving netstat -a command.
In case of TCP sockets:

--- cut ---
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 localhost:3000          *:*                     LISTEN
raw        0      0 *:icmp                  *:*                     7
raw        0      0 *:tcp                   *:*                     7
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node Path
unix  0      [ ACC ]     STREAM     LISTENING     384    /dev/gpmctl
unix  0      [ ]         STREAM     CONNECTED     190    @0000001b
unix  1      [ ]         STREAM     CONNECTED     1091   @00000031
unix  0      [ ACC ]     STREAM     LISTENING     403    /tmp/.font-unix/fs7100
unix  4      [ ]         DGRAM                    293    /dev/log
unix  1      [ ]         STREAM     CONNECTED     1092   /dev/gpmctl
unix  0      [ ]         DGRAM                    450
unix  0      [ ]         DGRAM                    433
unix  0      [ ]         DGRAM                    416
unix  0      [ ]         DGRAM                    308
--- cut ---

In case of Unix sockets:

--- cut ---
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
raw        0      0 *:icmp                  *:*                     7
raw        0      0 *:tcp                   *:*                     7
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node Path
unix  0      [ ACC ]     STREAM     LISTENING     384    /dev/gpmctl
unix  0      [ ]         STREAM     CONNECTED     190    @0000001b
unix  1      [ ]         STREAM     CONNECTED     1091   @00000031
unix  0      [ ACC ]     STREAM     LISTENING     1127   /var/drweb/run/drwebd.socket
unix  0      [ ACC ]     STREAM     LISTENING     403    /tmp/.font-unix/fs7100
unix  4      [ ]         DGRAM                    293    /dev/log
unix  1      [ ]         STREAM     CONNECTED     1092   /dev/gpmctl
unix  0      [ ]         DGRAM                    450
unix  0      [ ]         DGRAM                    433
unix  0      [ ]         DGRAM                    416
unix  0      [ ]         DGRAM                    308
--- cut ---

If there are no created sockets viewed that means there have occurred
loading problems.

To check DrWeb Daemon operability you can use the console client for the
daemon (drwebdc). Run it to get the service information on daemon. For TCP
socket:

$ drwebdc -nHOSTNAME -pPORTNUM -sv -sb

For Unix socket:

$ drwebdc -uSOCKETFILE -sv -sb

The following information should appear:

--- cut ---
Dr.Web daemon version: 4.27
Virus base: /var/drweb/bases/drwtoday.vdb (56 records)
Virus base: /var/drweb/bases/drw42702.vdb (116 records)
Virus base: /var/drweb/bases/drw42701.vdb (90 records)
Virus base: /var/drweb/bases/drwebase.vdb (27860 records)
Total virusfinding records : 28467
--- cut ---

If no correspondent information has been viewed try to enable the enhanced
diagnostics. For TCP socket:

$ drwebdc -nHOSTNAME -pPORTNUM -sv -sb -w

For Unix socket:

$ drwebdc -uSOCKETFILE -sv -sb -w

The more detailed output may clear out the situation:

--- cut ---
dwlib: startup: set timeout for whole session to -1 milliseconds (-1 means infinite)
dwlib: ipc: parse address string <inet:3001@localhost>
dwlib: tcp: call resolver for localhost
dwlib: tcp: resolver return 127.0.0.1
dwlib: tcp: connecting to 127.0.0.1:3001
dwlib: fd: connect() failed - Connection refused
Results: dwclient error -2 (internal transport subsystem)
Final code 0x10.
--- cut ---

Then take the test file eicar.txt (from the distributive package), turn it
into the program eicar.com with the help of the text editor (for instructions
see the file itself) and try to check it with the daemon. For TCP socket:

$ drwebdc -w -nHOSTNAME -pPORTNUM -f eicar.com

For Unix socket:

$ drwebdc -w -uSOCKETFILE -f eicar.com

Such a command must result in the following diagnostics:

--- cut ---
dwlib: startup: set timeout for whole session to -1 milliseconds (-1 means infinite)
dwlib: ipc: parse address string <inet:3000@localhost>
dwlib: tcp: call resolver for localhost
dwlib: tcp: resolver return 127.0.0.1
dwlib: tcp: connecting to 127.0.0.1:3000
Results: daemon return code 0x20 (known virus is found)
Final code 0x1.
--- cut ---

If it did not appear you should: 
- check in the daemon's log file if there is a record about checking that file
- enable enhanced diagnostics (see above).

If the checking has been completed correctly it means that the daemon is
operable.


                6. Checking modes realized by DrWeb Daemon (local scanning)

DrWeb Daemon has two main check modes:
- checking memory fragments received from socket;
- checking files on disc.

Let's dwell on these two modes at length. The first mode enabled, DrWeb
Daemon receives check data from the socket, practically it is a certain
data fragment. It may be named or not - it will effect only form of logging
in DrWeb Daemon's log file. Example of working in the mode is adduced in
the previous chapter - client read the file and sent it to the daemon for
checking. Basically the daemon can check any data fragment, not necessarily
a file.

The mode when the daemon scans the chosen file on disc is much more
efficient. Here only path to the file is reported to the daemon by the
client (whatever it is - console client or mail filter), the file itself
does not get transmitted. Attention!!! Important note: the path should be
specified in relation to the daemon (clients may located on other computers
etc.). What are the advantages of this mode? Firstly, it is more efficient,
secondly, it makes it easier to create an operational circuitry with curing
(for example, on file servers). But this mode requires a thorough right
setting, because the daemon must have read access to such a file, and in
the case of mail files and demo key - also write access. In the skillfully
set system the daemon in most cases does not require administrator rights
(root). But you should pay special attention to it when using it with mail
servers because filters usually work under the name of mail system (which
does not use root rights neither). In the most favorable mode filter
created a file with the message (having received it from mail system) and
reports its location to the daemon. At this point the rights to access the
directory where filters will create files should be carefully allotted. We
would recommend either to enclose the user whose rights are used by the
daemon in the mail subsystem group, or to run the daemon under the mail
system user.

                        
                7. DrWeb Daemon program API

This paragraph has been written for those going to write their own
integration modules for DrWeb Daemon. It consists of two articles. In the
first one daemon API itself is described, in the second one we describe the
library allowing to create your own integration module.

        7.1. Program API

First let's describe in general interaction of the client and DrWeb Daemon.
So, the interaction is described by the following sequence (INT stands for
parameters being 4 byte words in network order, STRING(n) stands for the
array of symbols of fixed length n):

- client establish connection with the daemon;
- outputs Cmd(INT) command, admissible commands:  
        DRWEBD_SCAN_CMD     1 - scan file or buffer
        DRWEBD_VERSION_CMD  2 - return DrWeb Daemon version
        DRWEBD_BASEINFO_CMD 3 - return information on antivirus bases
                                loaded by DrWeb Daemon
        DRWEBD_IDSTRING_CMD 4 - return information on DrWeb Daemon 
        DRWEBD_SCANPART_CMD 5 - scan file fragment
  for the scan file fragment command the following parameters are transmitted:
    - Offset(INT) - offset relational to the beginning of the file
    - Length(INT) - fragment length
  if it was one of the scan commands than the additional data is also needed:
    - ScanOptions(INT) - scan options as bit flags array (action flags do not
      regard files attached to message):
        DRWEBD_RETURN_VIRUSES   0x0001 - return names of the detected viruses
        DRWEBD_RETURN_REPORT    0x0002 - return scan log
        DRWEBD_RETURN_CODES     0x0004 - return extended codes
        DRWEBD_HEURISTIC_ON     0x0008 - use heuristic analyzer
        DRWEBD_CURE_FILES       0x0010 - cure file
        DRWEBD_SPAM_FILTER      0x0020 - use header filter
        DRWEBD_INFECTED_CURE    0x0040 - try curing infected file; if fails
                                         the file is treated as incurable
        DRWEBD_INFECTED_MOVE    0x0080 - move infected files
        DRWEBD_INFECTED_RENAME  0x0100 - rename infected files
        DRWEBD_INFECTED_DELETE  0x0200 - delete infected files
        DRWEBD_INCURABLE_MOVE   0x0400 - move incurable files
        DRWEBD_INCURABLE_RENAME 0x0800 - rename incurable files
        DRWEBD_INCURABLE_DELETE 0x1000 - delete incurable files
        DRWEBD_SUSPECTED_MOVE   0x2000 - move suspicious files
        DRWEBD_SUSPECTED_RENAME 0x4000 - rename suspicious files
        DRWEBD_SUSPECTED_DELETE 0x8000 - delete suspicious files
    - PathLen(INT) - name length (may equal to 0, than buffer is considered
      nameless and the next parameter Path is skipped);
    - Path(STRING(PathLen)) - buffer name or path to file (depends on the
      value of DataLen field);
    - DataLen(INT) - data block length, if it is 0 (must be 0 for scan
      fragment command), it means that Path is path to the file for the
      daemon to scan;
    - Data(STRING(DataLen)) - data block to be scanned.

- then the client awaits DrWeb Daemon's response, and reads the following
  data from the socket depending on the command:
    - for return version command: 
      Version(INT) - packed DrWeb Daemon version;
      Major = PackedVersion / 100,  Minor = PackedVersion % 100;
    - for information on DrWeb Daemon command: 
      IdLen(INT) - information string length and
      Id(STRING(IdLen)) - string itself;
    - for information on the loaded bases command:
      BaseNum(INT) - number of the loaded bases, and then for each base read: 
        NameLen(INT) - file name length with the base;
        Name(STRING(NameLen)) - base file name;
        VirCount(INT) - antivirus records number (in the base);
    - for scan commands:
      DaemonCode(INT) - daemon return code, contains bit fields with the
      events happened during scaning:
        DERR_NOERROR            0x00000000 - no errors
        DERR_READ_ERR           0x00000001 - read error(s), may occur both
                                             because of file physical
                                             inaccessibility (e.g., wrong
                                             access rights) and of logical
                                             damage of the document
        DERR_WRITE_ERR          0x00000002 - write error(s) (possible only
                                             when curing)
        DERR_NOMEMORY           0x00000004 - no memory
        DERR_CRC_ERROR          0x00000008 - integrity of the scanned
                                             archive(s) has been broken
        DERR_READSOCKET         0x00000010 - error in the log
        DERR_KNOWN_VIRUS        0x00000020 - virus(es) found
        DERR_UNKNOWN_VIRUS      0x00000040 - virus(es) suspected (possible
                                             only if heuristic analyzer is
                                             enabled)
        DERR_VIRUS_MODIFICATION 0x00000080 - virus modification(s) found
        DERR_FILE_IS_CURED      0x00000100 - file(s) cured
        DERR_TIMEOUT            0x00000200 - scan timeout has run out
        DERR_SYMLINK            0x00000400 - file(s) skipped because symlink
        DERR_NO_REGFILE         0x00000800 - file(s) skipped because not
                                             regular file 
        DERR_SKIPPED            0x00001000 - file(s) skipped, for example
                                             in ByType mode
        DERR_TOO_BIG            0x00002000 - file(s) skipped because
                                             MaxFileSizeToExtract exceeded
        DERR_TOO_COMPRESSED     0x00004000 - file(s) skipped because
                                             MaxCompressionRatio exceeded
        DERR_BAD_CALL           0x00008000 - wrong command
        DERR_EVAL_KEY           0x00010000 - DrWeb Daemon operates with demo
                                             key
        DERR_SPAM               0x00020000 - file(s) denied by the header
                                             filter (possible only if header
                                             filter is enabled)
    Then, if additional flags were specified:
        - return virus names:
          VirNum(INT) - number of detected viruses, modifications or
          suspected objects, for every virus:
            VirNameLen(INT) - record length;
            VirName(STRING(VirNameLen)) - record of the following type:
               infected with EICAR Test File (NOT a Virus!)
               or
               possibly infected with COM.TSR Virus
        - return scan log:
          LineNum(INT) - line number in the report, for each:
            LineLen(INT) - line length;
            Line(STRING(LineLen)) - report length, of the type:
               test.zip - archive PKZIP
               or
               >test.zip/test.doc - Ok
               or
               >test.zip/eicar.com - infected with EICAR Test File (NOT a Virus!)
        - return extended codes: 
            EventNum(INT) - number of pair (event - number of occurrences),
            for each:
              EventCode(INT) - event code;
              EventOccurency(INT) - number of occurrences.
            Example:
            2                       // number of pairs
            DERR_KNOWN_VIRUS,    1  // one file infected by the known virus
            DERR_TOO_COMPRESSED, 2  // two file exceeded compression ratio
    
        7.2. Use libdwclient.a library
             (or its thread-safe variant libdwclient_r.a) 

Together with filter source texts the library is delivered which will make
it easy for you to write your own integration modules. To get source code
and library, please, go to http://www.drweb.ru/unix/. There are two
variants of building it: non-thread-safe (-D__SIGNAL_BASED_DW) to write
single-threaded modules and thread-safe (-D__THREAD_BASED_DW) for
multi-threaded modules. The general way of using the library is to:

- set output mode by outputLib(..);
- start up the library startupLib(..);
- perform any functions getVersion(..), scanFile(..) etc.;
- clean up the report by clearResult(..);
- clean up the library cleanupLib();
   
Below library return function codes are adduced:

DWL_NOERROR      - no errors
DWL_COMMONERROR  - common error, as a rule when calling OS
DWL_IPCSYSTEM    - communication channel with the daemon error
                   (often wrong address)
DWL_BADFILE      - bad file transmitted
DWL_BADPARAMS    - wrong parameters transmitted
DWL_NOTSUPPORTED - the option is not supported
DWL_ALREADYEXEC  - trying to call startupLib for the second time
DWL_RECVERROR    - data transmitting error
DWL_SENDERROR    - data receiving error
DWL_NOMEMORY     - no memory
DWL_NOTINIT      - the library has not been initialized
DWL_TIMEDOUT     - timeout has run out

Here function prototypes are adduced, IN - input parameter, OUT - output
parameter, IN/OUT - parameter is both input and output:

extern void outputLib( char* Location, int Level, int Facility, int Priority );
 - Output mode setting
 * IN: Location - logging to syslog (NULL), console ("console") or to file
 * IN: Level - logging level (can be
               DW_LL_ERROR - only errors
               DW_LL_ALERT - DW_LL_ERROR + messages about exceptional cases
               DW_LL_INFO  - DW_LL_ALERT + some info messages 
               DW_LL_VERBOSE - DW_LL_INFO + more info messages
               DW_LL_DEBUG - DW_LL_VERBOSE + debug messages
 * IN: Facility - syslog facility (for example LOG_MAIL, LOG_DAEMON)
 * IN: Priority - syslog priority (for example LOG_INFO, LOG_ALERT)
 * DEFAULT OUTPUT MODE: all disabled

extern void printLib( const int level, char const* fmt, ... );
 - Information output by the library
 * IN: level - level of message (see dwc_log.h)
 * IN: fmt - format line (similarly to printf)

extern const char* getLibError( int code );
 - Get the line describing library return code 
 * IN: code - one of return codes described earlier

extern const char* getDaemonCode( int code );
 - Get the line describing daemon return code
 * IN: code - one of daemon return codes

extern int  startupLib( const char *Address, int Timeout, int Cache );
 - Starting up the library
 * IN: Version - version of interface (use const CURRENT_LIB_VERSION)
 * IN: Address - the line with daemon's address , as {FAMILY}:{ADDRESS}
 *     the following FAMILY admissible:
 *      inet - for TCP socket, than the address is inet:{PORT}@{HOST},
 *             PORT - port number, HOST - host name or IP address
 *             (e.g., inet:3000@localhost)
 *      local - for UNIX socket, than the address is unix:{SOCKETFILE} 
 *             SOCKETFILE absolute path to unix socket
 *             (for example, local:/opt/drweb/run/drwebd.skt)    
 *      pid - take daemon's address from PidFile it created, file:{PIDFILE} 
 *             PIDFILE - absolute path to file
 *             (for example, pid:/opt/drweb/run/drwebd.pid)
 * IN: Timeout - time (seconds) of performing a function scanFile, showID etc.;
 * IN: Cache - daemon's IP address caching (not 0 - permit, 0 - inhibit)

extern int  cleanupLib( void );
 - Clean up the library

extern int  getDaemonID( char** id_string );
 - View the daemon's log-string
 * OUT: id_string - contain allocated (by malloc) ID string, should be
        freed by caller

extern int  getVersion( int* major, int* minor );
 - View the daemon's version
 * OUT: major - major version
 * OUT: minor - minor version

extern int  getBases( char** list, int* total_records );
 - View the loaded bases list
 * OUT: list - string contain a list of loaded bases (freed by caller)
 * OUT: total_records - count of virusfindings recordes in bases

extern int  scanBuffer( void* Buffer, size_t BufferLen, int ScanOptions, int* result_ptr, char* log, size_t* loglen );
 - Scan data fragment in memory
 * IN: Buffer - memory pointer
 * IN: BufferLen - fragment size
 * IN: ScanOptions - scan options
 * IN/OUT: pResult - result of scanning (allocated by lib)
 * IN: ReportMaxSize - max size of daemon report or 
                       0 if dont to have restrictions

extern int  scanFile( char* Path, size_t PathLen, int Local, int ScanOptions, int* result_ptr, char* log, size_t* loglen );
 - Scan file
 * IN: Path - File name pointer (absolute path if Local is not 0)
 * IN: PathLen - file name length
 * IN: Local - if 0 readout file and send it to the daemon 
 *             if not 0 transmit file to the daemon for "local scanning"
 * IN: ScanOptions - scanning options
 * IN/OUT: pResult - result of scanning (allocated by lib)
 * IN: ReportMaxSize - max size of daemon report or 
                       0 if dont to have restrictions

extern int  scanFilePart( char* Path, size_t PathLen, size_t Offset, size_t Length, int ScanOptions, int* result_ptr, char* log, size_t* loglen );
 - Scan file fragment
 * IN: Path - pointer to absolute path to file
 * IN: PathLen - file name length
 * IN: Offset - offset from the beginning of the file
 * IN: Length - fragment length
 * IN: ScanOptions - scanning options
 * IN/OUT: pResult - result of scanning (allocated by lib)
 * IN: ReportMaxSize - max size of daemon report or 
                       0 if dont to have restrictions

extern int  getResultStatus( dwc_scan_result_t Res );
 - Extract status code from structure
 * IN: Res - pointer to structure with report (created by one of scan-function)
 * Return: combination of returned bits from file dwc_scan.h

extern char*  getResultReport( dwc_scan_result_t Res );
 - Extract report line from structure
 * IN: Res - pointer to structure with report
 * Return: report line or "report was not requested"

extern int  clearResult( dwc_scan_result_t Res );
 - Clear result structure after calling scan* routines and usage
 * IN/OUT: Res - pointer to structure with report, after call not valid pointer


                8. Contacts

As we have already noted, Doctor Web program gets constantly developed.
For updating information please see the sites at:

http://www.dials.ru
http://www.drweb.ru
http://www.drweb.ru/unix/forum
http://www.drweb.ru/unix

===============
You comments, suggestions and remarks you can forward to the antivirus
department of DialogueScience, Inc to:

Street address: 117786 Moscow, Vavilova st. 40, office 103.

Tel.(+7-095) 135-6253, 137-0150
Tel/fax      938-2970, 938-2855

FidoNet: 2:5020/69

WWW: http://www.dials.ru
FTP: ftp.dials.ru, ftp2.dials.ru, ftp3.dials.ru

E-mail: Antivir@dials.ru
         
To consult us the registered users can write to:
e-mail: Support@dials.ru, asv@drweb.ru

Please enclose the following information to help us in analyzing the
situation:

- Unix system distributive name and version;
- kernel and standard libc library version;
- versions of applications and filters with which Doctor Web Daemon
  integrates;
- Doctor Web Daemon version.
