Sav32cli.exe Command Line
Sav32cli.exe: The command line scanner capable of performing scans, disinfections and removal of viruses. Location: C: Program Files Sophos Sophos Anti-Virus sav32cli.exe For a full list of functionality run: sav32cli -h from the command prompt. Having an up-to-date SAV32CLI will ensure that the latest detection and cleanup information are available during the scanning process. If you intend to use the SAV32CLI found on your concerned computer, resolve first any existing installation or updating issue of the local Sophos Anti-Virus. Ensure SAV32CLI is up-to-date.
The TDL4 and it variants have been around for the last couple of years. It is an especially difficult virus / rootkit / bootkit to remove. It is estimated that the TDL4 Bootkit is part of a large worldwide Botnet infection of over 4 million computers. The bad guys are selling development kits to other cyber criminals so there are many variations out in the wild.. Tools to remove
1. Before Scanning, Disable 'System Restore' - START --> RUN --> control sysdm.cpl --> OK , Now Scan using the links on the left
2. Use multiple scanners (six to seven) to confirm the infection is cleaned, ONE AT A TIME. i.e. Install ONE antiviral program, scan, uninstall, install the next AV program, scan, uninstall.. (Web Scanners don't require an uninstall)
3. If infection remains, Start your computer in 'Safe Mode', and scan using links / buttons on the left and right - Note: some Web Scanners or AV applications may not work or install in safe mode.
4. If infection remains you'll need to go to the DOS prompt and locate and delete the infected files using one of the following methods:
a. Boot using a UBCD (UBCD4WIN) Rescue CD/DVD or USB bootable Flash Drive - scan using the SOPHOS command line program then manually delete infected files and registry settings
b. Or Boot using your XP / Vista install CD or Alternative Video if you don't have CD - scan using the SOPHOS command line program then manually delete infected files and registry settings
c. Or insert infected hard disk into an External USB enclosure or External IDE enclosure, connect to another computer and scan / disinfect
5. Use START --> RUN--> msconfig.exe to temporarily disable startup applications and non-Microsoft services -
a. Use START --> RUN--> Taskmgr.exe to list running services and applications
b. Research which services and startup applications are legitimate
6. Use the HijackThis tool to permanently disable startup applications, services and browser add-ins
7. If Internet Explorer is not working
a. Use another computer to download several anti-virus applications to a USB Flash Drive, insert the USB Flash Drive into the infected computer (WARNING), install one antivirus program at a time, scan and uninstall before installing the next AV application
b. Install Firefox from a Flash Drive - DO NOT IMPORT ANY Internet Explorer SETTINGS!
c. When the Viral Infection has been cleaned and confirmed it has been removed by using several antivirus scanners, Re-enable System Restore, upgrade to the latest Internet Explorer and update your windows operating system with all of the latest patches.
Additional Viral Remover Detailed information
1. Download UBCD using another clean, uninfected computer. Follow the documentation to BURN (create) a bootable UBCD4Win CD / DVD
2. Boot your infected computer using the bootable UBCD4Win CD / DVD
3. Create a Directory / Folder on the C drive of the infected computer. Name it SAV32CLI
4. Download Sophos emergency copy of SAV32CLI to the C:SAV32CLI - C drive SAV32CLI folder on the infected computer and extract into C:SAV32CLI
5. Also download latest virus identity IDE files to the C:SAV32CLI - C drive SAV32CLI folder on the infected computer and extract into C:SAV32CLI
6. Go to the DOS Prompt - (also called Command Prompt also called CMD Prompt) C: (Press the ENTER key) --> CDSAV32CLI --> (Press the ENTER key)
7. AT the C:SAV32CLI prompt enter SAV32CLI -DI -P=C:SCANLOG1.TXT --> (Press the ENTER key) the computer will now scan for viral Infections for about an hour
8. AT the C:SAV32CLI prompt enter SAV32CLI -DI -P=C:SCANLOG2.TXT --> (Press the ENTER key) the computer will now scan for viral Infections for about an hour
9. AT the C:SAV32CLI prompt enter SAV32CLI -REMOVE -P=C:REMOVLOG.TXT --> (Press the ENTER key) the computer will now scan for viral Infections for about an hour
10. Some Viruses may still remain. Disconnect the UBCD, Re-boot your computer into a normal windows session and rescan your computer with the following online tools
a. Trendmicro Housecall
b. Spybot Search and Destroy
c. ESET
d. ComboFix
e. Free Virus Removal Programs
Thanks For Visiting our web site.
This service allows you to help protect users from viruses by scanning each every mail that passes through. You can use almost any existing antivirus product to perform the scanning. You can also choose from a wide range of actions to perform in response to a virus being found. This includes deleting the mail, stripping infected attachments, sending new mails and more.
Sav32cli
Antivirus Filtering #
- Enable Antivirus Filtering - This controls whether the antivirus filtering is enabled.
- Max Simultaneous Scans - This controls the maximum number of antivirus scans that can be performed at any one time. If this limit is reached, mails will be held in a queue until an antivirus scan can be performed.
- Antivirus Scanners - This is a list of antivirus scanners that will be used to scan mail passing through your mail server. Scanners are performed sequentially and some scanners may affect subsequent scanners. Therefore, you can change the order of the scanners to achieve the desired effect.
- Add Preset - This allows you to add a preset antivirus scanner to help save time and give an indication of the kind of scanner that can be created.
Add / Edit Scanner #
- Enable Antivirus Scanner - This controls whether the antivirus scanner is enabled.
- Name - This is used to uniquely identify a scanner in the settings and also as an indication of the nature of the scanner. The name is only used in the settings and logs and does not have any effect during the scan being performed on any mails.
- Scan All Mail - If set, all incoming and outgoing mail will be scanned.
- Scan Incoming Mail - If set, only mail with one or more local SMTP recipients (incoming mail) will be scanned.
- Scan Outgoing Mail - If set, only mail with all external SMTP recipients (outgoing mail) will be scanned.
- Scan Raw Email Data - This controls whether a preliminary scan of the entire mail file is performed before each of its constituent parts is scanned separately. This can be used as an extra chance for a virus to be found in the mail as a whole. If a virus is found, some antivirus products may also attempt to fix the mail file by repairing or removing any infected part found.
- Scan Text and HTML Body Parts - If enabled, the HTML and text body parts of the mail will also be scanned.
- Application Path - This is the file path of the antivirus scanner application. It is perfectly legal to have this path set to a network location. For more information on using network drives, please view this Frequently Asked Questions page.
- Parameters - This is an optional set of parameters which will be passed to the application. You can also pass the mail file path as a parameter using the special tag of '%s', allowing relevant processing to be performed on the relevant file.
- Thread Priority - This controls the CPU priority of the antivirus scan. If your AV scanner is too slow or aggressively using the CPU, this option can allow you to compensate.
- Return Value - This is the value range to be compared against the return value given by the application. If the return value is in this range, this will indicate that a virus was found.
- Check For File Deletion - If set, the return value of an application will be ignored and instead a virus will be indicated by the antivirus application deleting the infected file. This is usually only necessary for antivirus applications that cannot indicate an infection via a return value.
- Hide Scanner Application Window - If enabled, the antivirus scanner application window will be hidden when executed.
- Classify File as Virus if Application Fails - If enabled and the antivirus application fails to complete the scan, the current mail part being scanned will be assumed to be virus.
- Load Approved Antivirus Scanner - This allows you to load in recommended settings for one of several antivirus products tested and approved by Code Crafters. These settings are only a recommendation and should be checked and tested before putting to use. Also, the provided 'Application Path' does not contain a full path name. This should be used has a guide to locate the actual file. If you require further information on configuring the scanner with your antivirus product, you should read the products documentation or contact the vendor.
- Test Antivirus Scanner - This allows you to perform a test scan using the EICAR test virus. This file is not a virus but should be recognized by most antivirus products as a means of testing setup without exposing your system to a real virus. This test will indicate any problems with your antivirus scanner setup. Please close down all other antivirus products running on your system before performing this test as other scanners will respond to the test file being created and may interfere with the test.
Approved Antivirus Scanners #
Ability Mail Server will work with any antivirus software that includes a command line scanner. Below are a few approved presets. However, newer versions of these antivirus products may have different settings to the ones below. You can use the command line help for the software or contact the software vendor for more details of the latest settings.
Antivirus Product | Application | Parameters | Returns |
---|---|---|---|
Norton Antivirus | navw32.exe | /b- /automation '%s' | Check for File Deletion |
Symantec Antivirus Scan Engine | savsecls.exe | -mode scan '%s' | 1:* |
McAfee VirusScan | scan.exe | /noboot /nobreak /nomem /silent /unzip '%s' | 1:* |
Sophos Antivirus | sav32cli.exe | -sc -s -nb -all '%s' | 1:* |
Grisoft AVG 32Bit | avgscanx.exe | /arc /heur /clean /scan='%s' | Check for File Deletion |
Grisoft AVG 64Bit | avgscana.exe | /arc /heur /clean /scan='%s' | Check for File Deletion |
F-Prot Antivirus | fpscan.exe | /archive=99 '%s' | 1:* |
avast! Professional Edition | ashcmd.exe | /c /i /p /s /t=a '%s' | 1:* |
ClamWin | clamscan.exe | --database='C:Documents and SettingsAll Users.clamwindb' '%s' | 1:* |
eScan Antivirus | avpdos32.exe | /m /p /b /s /y '%s' | 1:* |
CA eTrust Antivirus | Inocmd32.exe | -arc -nex '%s' | 1:* |
Eset Security | ecls.exe | /base-dir='C:Program FilesESETESET SecurityModules' /no-boots /arch /mail /sfx /rtp /adware /unsafe /unwanted /suspicious /pattern /heur /adv-heur /clean-mode=none /no-quarantine '%s' | 1:* |
Kaspersky Antivirus | avp.exe | scan /i4 /fe '%s' | 1:* |
Add / Edit Action #
All actions are shown in the table below followed by details of each action type.
Type | Action | Description |
---|---|---|
No Settings | Remove All Recipients | Removes all SMTP recipients. |
Set SPAM Flag | Sets the SPAM flag in the mail. | |
Remove SPAM Flag | Removes the SPAM flag in the mail. | |
Stop Filtering | Stops filtering. Subsequent actions and remaining Content Filter Rules / Antivirus Scanners are not evaluated. | |
Delete Email | Deletes the mail from the system. Subsequent actions for the current rule that do not affect the mail directly will still be performed. Further rules will not be performed. | |
Convert Text Content to HTML | Generates a HTML version of a plain-text only email based on the plain-text content. | |
Recipients | Redirect To | Removes all SMTP recipients and adds the recipients provided. |
Add Recipients | Adds the SMTP recipients provided. | |
Send Copy To | Sends a copy of the mail to the recipients provided. | |
Rename | Rename Recipients | Renames any SMTP recipients that match the substring search. |
Rename Attachments | Renames any attachments that match the substring search. | |
Remove | Remove Recipients | Removes any SMTP recipients that match the substring search. |
Remove Custom Event | Removes any custom events that match the substring search. | |
String | Add Custom Event | Adds the specified custom event to the mail. |
Place in Account Directory | Tries to deliver the mail to the specified account directory instead of the default 'Inbox' directory. | |
Rename Sender | Renames the SMTP sender to the provided address. | |
Edit Header Field | Edit Header Field | Replaces the field text of the specified header field. Adds the field if it does not exist. |
Add Signature | Add Signature | Appends text or HTML code to the base of a mail body. |
Strip Attachments | Strip Attachments | Strips any attachments that match the substring search. Optionally inserts 'removed attachments' message. |
Strip All | Strip All Attachments | Strips all attachments. Optionally inserts 'removed attachments' message. |
Strip All Infected Parts | Strips all infected parts of the mail. Optionally inserts ‘removed attachments' message. | |
New Mail | Send Email | Sends a new mail. |
Reply to Email | Sends a reply mail back to the SMTP sender. | |
Send Email to Recipients | Sends a new mail to all SMTP recipients. | |
Add Text to File | Add Text to File | Appends text to the specified file. Creates the file if it does not exist. |
Copy All to Directory | Copy All Attachments to Directory | Copies all attachments to a specified directory. Does not alter the attachments within the mail. |
Copy All Infected Parts to Directory | Copies all infected parts of the mail to a specified directory. Does not alter the infected parts within the mail. | |
Execute Application | Execute Application | Executes an application with the parameters provided. |
Action Type - No Settings #
This is the simplest type of action. Each action with this type requires no additional settings to be performed.
Action Type - Recipients #
'Recipients' actions control the recipients in the SMTP envelope which governs which email addresses the mail is delivered to.
- Recipients - This is a list of recipients which are to be affected by the appropriate action.
Action Type - Rename #
'Rename' actions are performed on a particular attribute based on its value matching the substring search criteria provided.
- Match Type - This controls what kind of substring search will be performed against the values supplied. This can be one of the following:
- String Matches - The value must match the substring provided.
- String Contains - The value must contain the substring provided.
- String Starts With - The value must start with the substring provided.
- String Ends With - The value must end with the substring provided.
- String Does Not Contain - The value must not contain the substring provided.
- Substring - This is the substring to be used with the given 'Match Condition' during the string search.
- Case Sensitive - If enabled, the string search will be case sensitive. Otherwise, a case in-sensitive search will be performed.
- Substring List - This allows a list of substrings to be used in the search instead of just one. The substrings are separated by semicolons (';'). If any one of the substrings matches the search criteria the condition will evaluate true.
- Rename To - This is what values matching the substring search will be renamed to.
Action Type - Remove #
The 'Remove' actions are performed on a particular attribute based on its value matching the substring search criteria provided.
- Match Type - This controls what kind of substring search will be performed against the values supplied. This can be one of the following:
- String Matches - The value must match the substring provided.
- String Contains - The value must contain the substring provided.
- String Starts With - The value must start with the substring provided.
- String Ends With - The value must end with the substring provided.
- String Does Not Contain - The value must not contain the substring provided.
- Substring - This is the substring to be used with the given 'Match Condition' during the string search.
- Case Sensitive - If enabled, the string search will be case sensitive. Otherwise, a case in-sensitive search will be performed.
- Substring List - This allows a list of substrings to be used in the search instead of just one. The substrings are separated by semicolons (';'). If any one of the substrings matches the search criteria the condition will evaluate true.
Action Type - String #
The 'String' actions are performed based on the string provided.
- Account Directory - This is the directory that mail will try to be delivered in instead of the default 'Inbox' directory. If the directory doesn't exist for a particular account, the mail will be placed in the 'Inbox' as normal.
- Custom Event - This is the custom event that will be added to the mail.
Action Type - Edit Header Field #
The 'Edit Header Field' action replaces the text of a particular header field. If the header field is not present it will be created.
- Standard Header Field - If set, the substring search will be performed on the header field selected from the combo box.
- Custom Header Field - If set, the substring search will be performed on the header field specified in the available text box.
- Text - This is the text that will replace the current header field text specified. This option allows the use of field tags, for more information please view the Using Field Tags page.
Action Type - Add Signature #
The 'Add Signature' action inserts a signature in the text and HTML body parts of a mail.
- Text Body Signature - This is the text which will be appended to the base of the text body part of the mail. This option allows the use of field tags, for more information please view the Using Field Tags page.
- HTML Body Signature - This is the HTML code which will be appended to the base of the HTML body part of the mail. This option allows the use of field tags, for more information please view the Using Field Tags page.
Action Type - Strip Attachments #
The 'Strip Attachment' action removes attachments that match the substring search criteria provided.
- Match Type - This controls what kind of substring search will be performed against the values supplied. This can be one of the following:
- String Matches - The value must match the substring provided.
- String Contains - The value must contain the substring provided.
- String Starts With - The value must start with the substring provided.
- String Ends With - The value must end with the substring provided.
- String Does Not Contain - The value must not contain the substring provided.
- Substring - This is the substring to be used with the given 'Match Condition' during the string search.
- Case Sensitive - If enabled, the string search will be case sensitive. Otherwise, a case in-sensitive search will be performed.
- Substring List - This allows a list of substrings to be used in the search instead of just one. The substrings are separated by semicolons (';'). If any one of the substrings matches the search criteria the condition will evaluate true.
- Insert Removed Attachment Message - This will cause an extra attachment listing all removed attachments to be added to the mail.
Action Type - Strip All #
The 'Strip All' actions remove all appropriate parts from the mail.
- Insert Removed Attachment Message - This will cause an extra attachment listing all removed attachments to be added to the mail.
Action Type - New Mail #
'New Mail' actions create new mail to be inserted into the mail server.
- From - This is the email address that will be used as the 'From' address of the mail.
- To - This is a list of recipients that will receive the mail. You can add more than one email address separated by semi-colons (';').
- Subject - This is the subject of the new mail. This option allows the use of field tags, for more information please view the Using Field Tags page.
- Message Text - If set, this will be the message body of the new mail. This option allows the use of field tags, for more information please view the Using Field Tags page.
- Message File - If set, the message body of the new mail will be the contents of this file.
Action Type - Add Text to File #
The 'Add Text to File' action appends the provided text to a given file. If the file does not already exist it will be created.
- File Path - This is the path of the file to be appended to. It is perfectly legal to have this path set to a network location. For more information on using network drives, please view the Frequently Asked Questions page.
- Text - This is the text that will be appended to the file. This option allows the use of field tags, for more information please view the Using Field Tags page.
Action Type - Copy All to Directory #
The 'Copy All to Directory' actions copy all appropriate parts of the mail to a specified directory. The parts remain in the mail.
This is the simplest type of action. Each action with this type requires no additional settings to be performed.
Action Type - Recipients #
'Recipients' actions control the recipients in the SMTP envelope which governs which email addresses the mail is delivered to.
- Recipients - This is a list of recipients which are to be affected by the appropriate action.
Action Type - Rename #
'Rename' actions are performed on a particular attribute based on its value matching the substring search criteria provided.
- Match Type - This controls what kind of substring search will be performed against the values supplied. This can be one of the following:
- String Matches - The value must match the substring provided.
- String Contains - The value must contain the substring provided.
- String Starts With - The value must start with the substring provided.
- String Ends With - The value must end with the substring provided.
- String Does Not Contain - The value must not contain the substring provided.
- Substring - This is the substring to be used with the given 'Match Condition' during the string search.
- Case Sensitive - If enabled, the string search will be case sensitive. Otherwise, a case in-sensitive search will be performed.
- Substring List - This allows a list of substrings to be used in the search instead of just one. The substrings are separated by semicolons (';'). If any one of the substrings matches the search criteria the condition will evaluate true.
- Rename To - This is what values matching the substring search will be renamed to.
Action Type - Remove #
The 'Remove' actions are performed on a particular attribute based on its value matching the substring search criteria provided.
- Match Type - This controls what kind of substring search will be performed against the values supplied. This can be one of the following:
- String Matches - The value must match the substring provided.
- String Contains - The value must contain the substring provided.
- String Starts With - The value must start with the substring provided.
- String Ends With - The value must end with the substring provided.
- String Does Not Contain - The value must not contain the substring provided.
- Substring - This is the substring to be used with the given 'Match Condition' during the string search.
- Case Sensitive - If enabled, the string search will be case sensitive. Otherwise, a case in-sensitive search will be performed.
- Substring List - This allows a list of substrings to be used in the search instead of just one. The substrings are separated by semicolons (';'). If any one of the substrings matches the search criteria the condition will evaluate true.
Action Type - String #
The 'String' actions are performed based on the string provided.
- Account Directory - This is the directory that mail will try to be delivered in instead of the default 'Inbox' directory. If the directory doesn't exist for a particular account, the mail will be placed in the 'Inbox' as normal.
- Custom Event - This is the custom event that will be added to the mail.
Action Type - Edit Header Field #
The 'Edit Header Field' action replaces the text of a particular header field. If the header field is not present it will be created.
- Standard Header Field - If set, the substring search will be performed on the header field selected from the combo box.
- Custom Header Field - If set, the substring search will be performed on the header field specified in the available text box.
- Text - This is the text that will replace the current header field text specified. This option allows the use of field tags, for more information please view the Using Field Tags page.
Action Type - Add Signature #
The 'Add Signature' action inserts a signature in the text and HTML body parts of a mail.
- Text Body Signature - This is the text which will be appended to the base of the text body part of the mail. This option allows the use of field tags, for more information please view the Using Field Tags page.
- HTML Body Signature - This is the HTML code which will be appended to the base of the HTML body part of the mail. This option allows the use of field tags, for more information please view the Using Field Tags page.
Action Type - Strip Attachments #
The 'Strip Attachment' action removes attachments that match the substring search criteria provided.
- Match Type - This controls what kind of substring search will be performed against the values supplied. This can be one of the following:
- String Matches - The value must match the substring provided.
- String Contains - The value must contain the substring provided.
- String Starts With - The value must start with the substring provided.
- String Ends With - The value must end with the substring provided.
- String Does Not Contain - The value must not contain the substring provided.
- Substring - This is the substring to be used with the given 'Match Condition' during the string search.
- Case Sensitive - If enabled, the string search will be case sensitive. Otherwise, a case in-sensitive search will be performed.
- Substring List - This allows a list of substrings to be used in the search instead of just one. The substrings are separated by semicolons (';'). If any one of the substrings matches the search criteria the condition will evaluate true.
- Insert Removed Attachment Message - This will cause an extra attachment listing all removed attachments to be added to the mail.
Action Type - Strip All #
The 'Strip All' actions remove all appropriate parts from the mail.
- Insert Removed Attachment Message - This will cause an extra attachment listing all removed attachments to be added to the mail.
Action Type - New Mail #
'New Mail' actions create new mail to be inserted into the mail server.
- From - This is the email address that will be used as the 'From' address of the mail.
- To - This is a list of recipients that will receive the mail. You can add more than one email address separated by semi-colons (';').
- Subject - This is the subject of the new mail. This option allows the use of field tags, for more information please view the Using Field Tags page.
- Message Text - If set, this will be the message body of the new mail. This option allows the use of field tags, for more information please view the Using Field Tags page.
- Message File - If set, the message body of the new mail will be the contents of this file.
Action Type - Add Text to File #
The 'Add Text to File' action appends the provided text to a given file. If the file does not already exist it will be created.
- File Path - This is the path of the file to be appended to. It is perfectly legal to have this path set to a network location. For more information on using network drives, please view the Frequently Asked Questions page.
- Text - This is the text that will be appended to the file. This option allows the use of field tags, for more information please view the Using Field Tags page.
Action Type - Copy All to Directory #
The 'Copy All to Directory' actions copy all appropriate parts of the mail to a specified directory. The parts remain in the mail.
- Directory Path - This is the directory that all parts will be copied to. It is perfectly legal to have this path set to a network location. For more information on using network drives, please view the Frequently Asked Questions page.
Action Type - Execute Application #
The 'Execute Application' action executes a specified application.
- Application Path - This is the file path of the application to be executed. It is perfectly legal to have this path set to a network location. For more information on using network drives, please view the Frequently Asked Questions page.
- Parameters - This is an optional set of parameters which will be passed to the application. This option allows the use of field tags, for more information please view the Using Field Tags page.
- Hide Application Window - If enabled, the application window will be hidden when executed.
See Also:Using the Antivirus Filtering Service, Using Field Tags.