McAfee VCLCDE-AA-DA Product Guide - Page 20

VirusScan® Command Line 5.20.0 Product Guide 3 Using the Command-Line Scanner Scanning processes in memory The cache is allocated "per file", so the scanner uses a large amount of cache if there are many nested files. A larger cache size normally improves scanning speeds unless the computer has very low memory. A range of cache sizes - 8MB to 512MB - is permitted. If you specify a value outside this range, the minimum or maximum value is assumed as appropriate. If you do not use this option, the scanner uses the default value of 12MB. Scanning processes in memory Viruses such as CodeRed do not exist as files on disk but rather as executable code in the memory space of an infected process. To protect against this threat, you can include the /WINMEM option. The process is scanned in memory together with any files or DLLs associated with it. When using the /WINMEM option, specify at least one file for scanning as well. Note Examples SCAN EXAMPLE.EXE /WINMEM Scans the file EXAMPLE.EXE and all processes running on the computer. SCAN *.EXE /WINMEM Scans all files with a ".EXE" file name extension in the current directory, and all processes running on the computer. SCAN *.* /WINMEM Scans all files in the current directory and all processes running on the computer. SCAN AA.EXE /WINMEM=1234 Scans the file, AA.EXE in the current directory and the specified process, 1234. The parameter is the process identifier or PID. If the process is not running, the scanner issues a message. Running an on-demand scan You can scan any file or directory on your file system from the command line by adding options to the basic command. When executed without options, the program simply displays a brief summary of its options. When executed with only a directory name specified, the program scans every file in that directory only, and issues a message if any infected files are found. The options fall into the following main groups: „ Scanning options - determine how and where the scanner looks for infected files. See page 25. 20