Help on module file:

class f2s(file2stream)
|  An alias for file2stream interscanner
|  

class file2stream(avlib.interscanner)
|  file2stream interscanner
|  
|  Usage: file2stream(scanner1())
|  
|  Where: scanner1() is an interscanner or realscanner.
|           It must be a streamscanner.
|  
|  This scanner converts a filescanner input into streamscanner.
|  

class s2f(stream2file)
|  An alias for stream2file interscanner.
|  

class stream2file(avlib.interscanner)
|  stream2file interscanner
|  
|  Usage: stream2file(scanner1())
|  
|  Where: scanner1() is a interscanner or realscanner.
|           It must be a filescanner.
|  
|  You can use it to save streams into files.
|  

class stream2mbox(stream2file)
|  An alias for stream2file(...,1) interscanner.
|  

Help on module match:

class alternatives(match_class)
|  alternatives() interscanner
|  
|  Usage: alternatives(scanner1(),scanner2(),...)
|  
|  Where: scanner1(),... are scanners, which may find a virus
|  
|  Returns a virus, if one scanner returns a virus.
|  Scannig is ended if one scanner returns virus or clean.
|  Next scanner from the list is used, if previous scannes fails
|  (raises an error). Raises an ScannerError, if all scanners failed.
|  

class match_all(match_class)
|  match_all() interscanner
|  
|  Usage: match_all(scanner1(),scanner2(),...)
|  
|  Where: scanner1(),... are scanners, which must find a virus
|  
|  Returns a virus only if all scanners returns a virus.
|  

class match_any(match_class)
|  match_any() interscanner
|  
|  Usage: match_any(scanner1(),scanner2(),...)
|  
|  Where: scanner1(),... are scanners, which may find a virus
|  
|  Returns a virus, if one scanner returns a virus.
|  Next scanner from list is used, if previous scanner returns
|  no virus, or failed (raised an error).
|  

class match_class(avlib.interscanner)
|  parent class for all match clases
|  

class nothing(match_any)
|  nothing interscanner
|  
|  Usage: nothing([some parameters...])
|  
|  Where: [some parameters...] are ignored :)
|  
|  This scanner does nothing. :-)
|  

class recover(match_any)
|  recover() interscanner
|  
|  Usage: recover(scanner1(),scanner2(),...)
|  
|  Where: scanner1... are scanners
|  
|  This scanner can be used to recover from scanner fail. If an scanner
|  fails (raises an error), this scanner return no virus.
|  

Help on module actions:

class deliver(match.match_any)
|  deliver() - a class to force sending some viruses/spams
|  
|  usage: deliver(deliver_pattern,scanners)
|  
|  where: deliver_pattern is an regular expression, which defines
|           virus name to really deliver, other emails will not be delivered.
|  
|  This scanner can be used to send some viruses/spams.
|  You can define by regular expression, what virus name or spam
|  can be sent.
|  

class deliver_to(match.match_any)
|  deliver_to() - an interscanner to send emails to admins
|  
|  Usage: deliver_to(recipients,scanners)
|     or: deliver_to(...).onlyif('string')
|  
|  Where: recipients is an array of recipients
|         'string' is an string, which defines regular expression.
|           If this expression is found in virus name, mail is
|           delivered, otherwise don't.
|  
|  This scanner can be used to send viruses/spams to an administrator.
|  

class drop(match.match_any)
|  drop() - a class to DROP viruses/spams, by default they are REJECTED
|  
|  usage: drop(drop_pattern,scanners)
|  
|  This scanner can be used to drop some viruses, like Klez.
|  Klez sends fake sender address and this virus can't be sent
|  back to sender, because sender is faked.
|  
|  This scanner does nothing else, like sets the DROP flag.
|  Email is passed to parent scanners and is dropped in sagator.
|  

class quarantine(match.match_any)
|  quarantine() - quarantine into any directory
|  
|  usage: quarantine('qdir','dont quarantine regular expression',scanners)
|  
|  where: 'qdir' is a string, which defines a qatantine directory,
|                directory, in which viruses/spams are stored.
|                This string can contain %X substrings. These strings
|                are represented as defined in strftime. For more information
|                see "man strftime". If this directory not exitst,
|                it's created.
|         'dont quarantine regular expression' is a regular expression,
|                which defines virus names, which can't be quarantined
|  
|  Example: quarantine('/tmp/quarantine/%Y%m', a_scanner())
|             - every month will be stored in separate directory
|  
|  This scanner can be used to quarantine an virus/spam.
|  qdir is a directory, in which viruses are stored.
|  Following regular expression can be used to disable quarantining
|  of some viruses or spams.
|  

Help on module report:

class report(match.match_any)
|  report() interscanner - report any message to admin, user or anybody
|  
|  usage: report(recipients, msg, scanners)
|  or:    report(...).sender('<email@of.sender.dom>')
|  or:    report(...).ifscan(cond_scanner)
|  
|  where: recipients is an array of recipients,
|           like: ['<r1@dom>','<r2@dom>',...]
|         msg is an message template, you can use report.MSG_TMPL
|         cond_scanner is a scanner, which defines, when report may be sent
|  
|  This module can be used to report an message to administrator
|  or to any user.
|  
|  You can use following variables in report messages:
|    $FROM               report sender
|    $VIRNAME            detected virus name
|    $SMTP_COMM          SMTP communication
|    $STATUS             status of this message (REJECTED, DROPPED, ...)
|    $QNAME              filename in quarantine
|    $SCANNER_OUTPUT     returned scanner output
|    $SCANNER_NAME       name of the scanner
|    $MSG_HEADER         virus/spam header
|    $MSG_BODY           virus/spam body (without header)
|    $RANDOM             10 random characters (useable to generate a boundary)
|    $SENDER             virus/spam sender
|    $RECIPIETNS         virus/spam recipients joined by comma (',')
|    $TO                 report recipeints
|    $VERSION            sagator's version
|  

class report_recipients(report)
|  report_recipients() interscanner - report any message to mail recipients
|  
|  usage: report_recipients(msg, scanners)
|  or:    report_recipients(...).sender('<email@of.sender.dom>')
|  or:    report(...).ifscan(cond_scanner)
|  
|  where: msg is an message template, you can use report.MSG_TMPL
|          scanners are scanners which are used
|         cond_scanner is a scanner, which defines, when report may be sent
|  
|  This module can be used to report an message to mail recipients.
|  For message description see report() scanner.
|  

Help on module header:

class add_header(match.match_any)
|  add_header() - add email header
|  
|  usage: add_header('Header_name','header_data',scanners)
|     or: add_header(...).onlyif('virname')
|  
|  where: 'Header_name' is a string, which defines name of the header
|         'header_data' is a string, which defines header's content
|         'virname' is a string, which defines any virus name.
|           By default all virus names longer than 1 character: '.'
|         There are some special pattern, which are replaced:
|           %V ... virus name
|           %S ... scanner name
|  
|  This scanner can be used to add an header line to email.
|  

class modify_header(add_header)
|  modify_header() - modifying email headers
|  
|  usage: modify_header('^Header_regexp:','Header_regexp: prefix',scanners)
|     or: modify_header(...).onlyif('virname')
|  
|  where: '^Header_regexp:' is a string, which defines regular expression
|           to find for this header
|         'Header_regexp: prefix' is a string, which defines new header
|           data
|         'virname' is a string, which defines any virus name.
|           By default all virus names longer than 1 character: '.'
|         There are some special pattern, which are replaced:
|           %V ... virus name
|           %S ... scanner name
|  
|  This scanner can be used to modify email headers.
|  

class modify_subject(modify_header)
|  modify_subject() - modifying email Subject
|  
|  usage: modify_subject('prefix',scanners)
|     or: modify_subject(...).onlyif('virname')
|  
|  where: 'prefix' is an prefix added into Subject.
|         'virname' is a string, which defines any virus name.
|           By default all virus names longer than 1 character: '.'
|         For more information see modify_header() interscanner.
|  
|  This scanner can be used to modify email Subject.
|  For example original Subject line is:
|    Subject: Testing mail
|  and i use:
|    deliver(...).modify_subject('[SPAM]')
|  Header will be modifyed to:
|    Subject: [SPAM] Testing mail
|  

Help on module logger:

class log(report.report)
|  Advanced logger interscanner.
|  
|  usage: log(logto,format,scanners...)
|  
|  where: logto is a string, which defines filename to store these data
|           If logto is an integer, it defines log level in standard
|           log file.
|         format is a string, which defines data format
|  
|  This scanner can be used to log some special data.
|  You can use these variables in format string:
|    $LEVEL              - detected virus level
|    $VIRNAME            - name of detected virus, empty if CLEAN
|    $STATUS             - if mail is dropped, rejected, ...
|    $QNAME              - quarantine file name
|    $SCANNER_NAME       - scanner which reported this virus
|    $SENDER             - scanned message sender
|    $RECIPIENTS         - scanned message recipients
|    $SIZE               - email size
|    $VERSION            - sagator's version
|  
|  You also can use log.FORMAT for default format.
|  

class log_mysql(_log_sql)
|  MySQL logger interscanner.
|  
|  usage: log_mysql(host, port, dbname,dbuser,dbpass,format,scanners...)
|  
|  where: host is a string, which defines MySQL database hostname
|           (you can use "127.0.0.1", UNIX socket can't be used in chroot)
|         port is an integer, which defines MySQL database TCP port number
|           (it is by default 3306)
|         dbuser is a string, which defines username which can log to DB
|         dbname is a string, which defines database name
|         dbpass is a string, which defines user password
|         format is a string, which defines data format.
|           For detailed format description see log() scanner documentation.
|           You also can use log.FORMAT for default format.
|  

class log_pgsql(_log_sql)
|  PosgreSQL logger interscanner.
|  
|  usage: log_pgsql(host, port, dbname,dbuser,dbpass,format,scanners...)
|  
|  where: host is a string, which defines pgsql database hostname
|           (you can use "localhost", UNIX socket can't be used in chroot)
|         port is an integer, which defines pgsql database TCP port number
|           (it is by default 5432)
|         dbuser is a string, which defines username which can log to DB
|         dbname is a string, which defines database name
|         dbpass is a string, which defines user password
|         format is a string, which defines data format.
|           For detailed format description see log() scanner documentation.
|           You also can use log.FORMAT for default format.
|  

class log_sqlite(_log_sql)
|  SQLite logger interscanner.
|  
|  usage: log_sqlite(dbname,format,scanners...)
|  
|  where: dbname is a string, which defines, which database to use
|         format is a string, which defines data format.
|           For detailed format description see log() scanner documentation.
|           You also can use log.FORMAT for default format.
|  

Help on module parsemail:

class parsemail(avlib.interscanner)
|  mimeparse interscanner
|  
|  Usage: parsemail(scanner1(...))
|  
|  This scanner parses emails and send multiple of streams into
|  scanner1(). If an multiscanner is used as another_scanner,
|  optimal method is used (scans all files at once).
|  

Help on module mimeparse:

class file_type(avlib.ascanner)
|  file_type() is a realscanner, which scans type of a file
|  
|  Usage: file_type({'type':'vir',...})
|  
|  Where 'type' is a name of type returned by filetype.* function
|        'vir' is a vir name returned, if file type is matched
|  

class mime_ext(avlib.ascanner)
|  mime_ext() is a extension scanner.
|  
|  Usage: mime_ext('wrong types regular expressios')
|  
|  This scanner checks defined extension of file in mime attachments.
|  Regexp checks with ignoring of case are used.
|  You can use predefined extensions from mime_ext.EXECUTABLES,
|  for example:
|    mime_ext(mime_ext.EXECUTABLES)
|  

class mime_ext_int(avlib.ascanner)
|  Internal scanner for mime_ext.
|  
|  This scanner checks defined extension of file.
|  Regexp check with ignoring of case is used.
|  

class mimeparse(avlib.interscanner)
|  mimeparse interscanner
|  
|  Usage: mimeparse(scanner1(...))
|  
|  This scanner parses MIME attached mail and send multiple of
|  streams into another_scanner(). If an multiscanner is used
|  as scanner1(), optimal method is used (scans all files
|  at once).
|  

Help on module decompress:

class decompress(avlib.interscanner)
|  decompress scanner - used to decompress zip,rar,arj,zoo,tar,...
|  
|  Usage: decompress(filescanner1(),[a,b,c,d])
|  
|  Where: filescanner1() is an filescanner, which can scan all files
|         [a,b,c,d] is an array of 4 numbers:
|           a = max number of recursions
|           b = max number of decompressed files
|           c = max disk usage with all of decompressed files
|           d = max address space usage
|  
|  It is a scanner, which can decompress some of files.
|  You can define your own decompressors and assing it to any extensions.
|  This scanner is a filescanner only, because external decompressors
|  can unpack only files. A used scanner must be also a filescanner.
|  If not, use file2stream() interscanner.
|  
|  Filetype is determined on file content (not on file extension).
|  It can detect some exe SFX archives too.
|  

Help on module store:

class restore(match.match_any)
|  Restore scanner return value.
|  
|  Usage: restore('VAR')
|  
|  Where: 'VAR' is a string, which defines variable name to store return value
|  
|  Example: store('var1')
|  
|  This scanner return's return value for previously stored variable.
|  

class store(match.match_any)
|  Store scanner return value.
|  
|  Usage: store('VAR',scanners...)
|  
|  Where: 'VAR' is a string, which defines variable name to store return value
|  
|  Example: store('var1', scanner1())
|  
|  This scanner return's return value for a scanner included into
|  and stores it's value into a variable.
|  

Help on module basic:

class const(avlib.ascanner)
|  const() realscanner
|  
|  Usage: const(level,'VirName',['virreturnstringline1',...])
|      or const()
|  
|  Where: level is an float which defines returned infection level
|           If level is not defined, after scanning an error is raised.
|         'VirName',[...] is a returned virus.
|  
|  This scanner has no real functionality. It return always
|  a defined virus, or clean (if virus is not defined).
|  This scanner has no error codes.
|  

class exec_any(avlib.ascanner)
|  exec_any() realscanner
|  
|  Usage: exec_any(['command','arg1',...],[statusA1,...],[statusB1,...])
|  
|  Where: 'command' is a string, which command to run
|         'argX' are command line arguments, as last argument the
|           filename is added
|         statusA1,... are integers, which defines "clean" exit codes
|         statusB1,... are integers, which defines "virus found" exit codes
|  
|  If command returns exit status 0, no virus is returned.
|  If exit code is any from statusX, virus is returned.
|  Otherwise an error is raised.
|  

class max_file_size(avlib.ascanner)
|  max_file_size() realscanner
|  
|  Usage: max_file_size(size[,'name'])
|  
|  Where: size is a number of bytes, which if exceeded, virus is returned
|         'name' is a string, which identifies the virus name.
|            If it is not present, 'FileSizeOverrun' is returned.
|  

class regexp_scan(avlib.ascanner)
|  Primitive regexp pattern scanner.
|  
|  Usage: regexp_scan({'VirName':['RegExp_Pattern...',...],...} [,size])
|  
|  Where: 'VirName' is a string, which identifies defined virus
|         'RegExp_Pattern...' is a regexp pattern
|         size is a number, which defines, how many bytes may be checked.
|           If it is 0 or not defined, whole stream is scanned.
|           If it is -1, email header is scanned.
|    
|  There can be more patterns for one virus. All patterns
|  must match to assign an stream as virus.
|  There can also be more virnames in one dictionary.
|  

class smtp_comm(avlib.ascanner)
|  Primitive regexp pattern scanner for SMTP communication.
|  
|  Usage: smtp_comm({'VirName':['RegExp_Pattern...',...],...})
|  
|  Where: 'VirName' is a string, which identifies defined virus
|         'RegExp_Pattern...' is a regexp pattern
|    
|  For more information about this scanner see documentation for
|  regexp_scan realscanner.
|  
|  This scanner also can be used to apply some scnanner to defined
|  email adresses. For example:
|  
|      match_all(
|        smtp_comm({'anydomain:':['^RCPT TO:.*anydomain.dom']}),
|        stream2mbox(libclam())
|      )
|  
|  In this example, libclam() scanner is used only if mail is
|  adressed to an user on anydomain.dom.
|  

class string_scan(avlib.ascanner)
|  Primitive string pattern scanner.
|  
|  Usage: string_scan({'VirName':['Pattern...',...],...} [,size])
|  
|  Where: 'VirName' is a string, which identifies defined virus
|         'Pattern...' is a string pattern
|         size is a number, which defines, how many bytes may be checked.
|           If it is 0 or not defined, whole stream is scanned.
|           If it is -1, email header is scanned.
|    
|  There can be more patterns for one virus. All patterns
|  must match to assign an stream as virus.
|  There can also be more virnames in one dictionary.
|  

Help on module dazuko:

class dazuko(avlib.ascanner)
|  Scanner which uses dazuko directory to scan for viruses.
|  
|  Usage: dazuko('/dazuko_prefix','logfile')
|  
|  Where: '/dazuko_prefix' is a string, which defines directory
|            and a part of filename to store scanned files,
|            by default '/tmp/dazuko'
|         'logfile' is a string, which defines full path and filename
|            of logfile, by default not logfile used
|         'regexp' is a string, which defines how to parse logfile
|  

Help on module clamav:

class clamd(avlib.ascanner)
|  clamd realscanner
|  
|  Usage: clamd(['localhost',3310])
|     or: clamd('/var/spool/vscan/clamd')
|  
|  Where: 1st definition defines a clam daemon on host localhost,
|             port 3310 (it is the default)
|         2nd definition defines access to clamd via UNIX socket
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. ClamAV is a free program under GPL and may be freely
|  used. Its database is very well.
|  
|  If you need a chrooted clamd, copy it into chroot and start it
|  from here. If you are not familiar with it, use clamscan scanner
|  from this module. It easily does chroot support, but it
|  is not powerfull.
|  

class clamscan(avlib.ascanner)
|  clamscan() realscanner - clamav scanner
|  
|  Usage: clamscan(['/usr/bin/clamscan','--stdout','--infected',
|                   '--disable-summary','-r','--mbox'])
|  
|  Where: in [] are command line parameters for clamscan binary
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. ClamAV is a free program under GPL and may be freely
|  used. Its database is very well.
|  
|  It can be easily used in chroot. mkchroot.sh from sagator package
|  automatically integrates it into chroot environment.
|  
|  WARNING: If you are using clamscan from chroot, you need to configure
|           freshclam to update chrooted copy of database!!!
|  

class libclam(avlib.ascanner)
|  libclam realscanner - uses libclamavmodule python library
|  
|  Usage: libclam([options[,limits]])
|  
|  Where: options is an number, whic defines libclam options,
|           see clamav documentation for more info
|         limits is an tuple, which defines limits for clamav
|           decompressor, see clamav doc. for more info
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. ClamAV is a free program under GPL and may be freely
|  used. Its database is very well.
|  
|  WARNING: Streamscanner ignores options and limits!
|  
|  WARNING: Streamscanner can't scan mailboxes and archives.
|           Use parsemail() for emails anb if you need also
|           archive support, use decompress() interscanner.
|  
|  WARNING: If you are using clam from chroot, you need to configure
|           freshclam to update chrooted copy of database!!!
|  

Help on module avg:

class avgd(avlib.ascanner)
|  avgd realscanner
|  
|  Usage: avgd([[[params],connto],chroot])
|  
|  Where: params is a string which defines command line parameters,
|           like -arc, -heur, -rt, ... see man page for avgscan
|           By default "-arc -heur -rt" is used now.
|         connto is a tuple of host,port of avgd, by default ('localhost',55555)
|         chroot is an string in which sagator is running, if avgd
|           is not running in this chroot
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. It uses AVGd (a deamonized linux version of AVG7).
|  
|  To start AVGd in chroot, move all neccessary files into your chroot,
|  and change following line in init.d/avgd from:
|    daemon $AVG_HOME/avgscan -d
|  to:
|    daemon chroot /var/spool/vscan $AVG_HOME/avgscan -d
|  or similiar.
|  

Help on module bdc:

class bdc(avlib.ascanner)
|  Bitdefender realscanner
|  
|  Usage: bdc(command)
|  
|  Where: command is a array which defines command with parameters.
|           By default: ['/opt/bdc/bdc','--mail','--all','--arc']
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. It parses Bitdefender output.
|  
|  Warning: If you are using bdc in chroot, don't forget to mount
|           /proc directory under chroot.
|  

Help on module nod:

class nod2(avlib.ascanner)
|  NOD2 scanner. Works with nod32lfs.
|  
|  Usage: nod2(['command','params...'])
|  
|  Where: in [] are command line parameters for nod32
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. You can use nod32 from nod32lfs package.
|  

class nod2dazuko(dazuko.dazuko)
|  NOD32lfs scanner over dazuko module.
|  
|  Usage: nod2dazuko('/dazuko_prefix','logfile')
|  
|  Where: '/dazuko_prefix' is a string, which defines directory
|            and a part of filename to store scanned files,
|            by default '/tmp/dazuko'
|         'logfile' is a string, which defines full path and filename
|            of logfile, by default not logfile used
|  

class nodold(avlib.ascanner)
|  NOD32d scanner. This works only with nod32d from ESET.
|  
|  Usage: nodoldd(['host',port],params)
|  
|  Where: 'host' is a string, which defines a host of nod32d
|            (by default 'localhost')
|         port is a number, which defines a port of nod32d
|            (by default 8448)
|         params is a string to define scanner parameters.
|            It's defaults to "@patt:1@heur:2@clean:0".
|            There is no format description.
|  
|  This scanner mat be used to scan for viruses by ESET's NOD32.
|  Only old version (buyed directly from ESET) may be used.
|  
|  WARNING! NOD32 can't scan direct mboxes and archives.
|  You need parsemail() module to parse mailboxes. For exmple:
|    mimeparse(stream2file(nodoldd(['localhost',8448])))
|  If you need also unpacker support, add decompress interscanner:
|    mimeparse(stream2file(decompress(nodoldd(['localhost',8448]))))
|  
|  If you want start nod32d in chroot, use for example:
|    exec chroot /var/spool/vscan /opt/nod32/nod32d
|  from any script.
|  

Help on module icap:

class savse(avlib.ascanner)
|  savse() realscanner - symantec antivirus scan engine scanner
|  
|  Usage: savse('host',port)
|  
|  Example: parsemail(savse('localhost',1344))
|  
|  Comments:
|    You need to configure ICAP protocol on port 1344 (or another)
|    to use this scanner properly.
|    These options are suggested in symcscan.cfg:
|      BindAddress=127.0.0.1
|      Port=1344
|      Protocol=ICAP
|      ExtensionPolicy=0
|      ICAPActionPolicy=SCAN
|      ICAPResponse=1
|  

Help on module sophie:

class sophie(avlib.ascanner)
|  sophie realscanner
|  
|  Usage: sophie(sophie_socket,chroot_path)
|  
|  Where: sophie_socket is a filename to sophie via UNIX socket
|         chroot_path is a path, which you need to add
|           (may be the same as your CHROOT, if you are using
|           sagator in chroot and sophie not)
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. Sophie uses sophos libsavi. It can also be used
|  for Trophie with TrendMicro antivirus scanner.
|  
|  If you need a chrooted sophie, copy it into chroot and start it
|  from here. Do not forget to update it's chrooted database.
|  

class trophie(sophie)
|  trophie realscanner
|  
|  It is an alias for sophie. See sophie documentation.
|  

Help on module kav:

class kav(avlib.ascanner)
|  Kaspersky realscanner
|  
|  Usage: kav(command)
|  
|  Where: command is a array which defines command with parameters.
|           By default: ['/opt/kav/bin/kavscanner','-j3']
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. It parses Kaspersky antivirus output.
|  

class kavclient(kav)
|  Kaspersky antivirus client realscanner
|  
|  Usage: kavclient([socket_path [,command]])
|  
|  Where: socket_path is a string, which defines path co aveserver socket
|           inside chroot. (default: /var/run/aveserver)
|         command is a string, which defines command to run.
|           (default: /opt/kav/bin/aveclient)
|  
|  This scanners is a realscanner, which can be used to scan
|  for viruses. It parses Kaspersky antivirus client output.
|  

Help on module sanitize:

class sanitize(avlib.ascanner)
|  sanitize realscanner
|  
|  Usage: sanitize([insert_pattern[,extensions_reg_exp]])
|  
|  This scanners is a realscanner, which can be used to sanitize
|  email. It means all attachments are renamed to safe names.
|  
|  For example:
|    filename.exe will be renamed to filename-exe
|  
|  WARNING! This scanner is in BETA stage! Id don't conform to RFC 2183!
|  

Help on module spamassassin:

class spamassassin(avlib.ascanner)
|  SpamAssassin scanner
|  
|  Usage: spamassassin(['/usr/bin/spamassassin','-e'],SPAMSTRING,SA_MAX_FILE)
|  
|  Where: in [] is a path and argumets of spamassassin binary
|         SPAMSTRING is a string, which define a spamassassin report,
|           which is checked. If it is found, mail is assigned as 'SPAM'
|           (by default all reports with exit status!=0 are reported as spam).
|         SA_MAX_FILE is a number, which defines maximum file size,
|           which can be tested. If a mail (with header) is larger,
|           it is not checked (by default 500000).
|  
|  This scanner scans for spams. If a spam is returned, a string
|  SPAM is returned as virus name. This scanner uses a spamassassin
|  binary. For better performance, configure spamd and use
|  spamassassind.
|  
|  WARNING! You need to install spamassassin into chroot manually.
|  mkchroot.sh script does it not. If you want to use spamassasin
|  with chroot and don't want to make a copy in chroot, use
|  a spamassassind scanner, but remember, that scanning for spams
|  are not done in chroot environment.
|  
|  WARNING! This scanner is not fully compatible with header adding.
|  Some data from headers are not added!
|  

class spamassassind(avlib.ascanner)
|  SpamAssassinD scanner
|  
|  Usage: spamassassind(['localhost',783],REQ_SPAM_LEVEL,SA_MAX_FILE)
|  
|  Where: ['localhost',783] are the host and port of spamd.
|         if REQ_SPAM_LEVEL is less than spam hits, virus is returned,
|           if it is -1 (default), spam level from spamassassin config is used
|         for SA_MAX_FILE see spamassassin scanner description.
|  
|  This scanner scans for spams. If a spam is returned, a string
|  SPAM is returned as virus name.
|  This scanner uses a spamassassind daemon. If you are not familiar with it,
|  you also can use spamassassin binary. Look at spamassassin scanner.
|  

Help on module bogofilter:

class bogofilter(avlib.ascanner)
|  BogoFilter scanner
|  
|  Usage: bogofilter(['/usr/bin/bogofilter','-v'],SPAMSTRING,MAX_FILE_SIZE)
|  
|  Where: in [] is a path and argumets of bogofilter binary
|         SPAMSTRING is a string, which define a report string,
|           which is checked. If it is found, mail is assigned as 'SPAM'
|         MAX_FILE_SIZE is a number, which defines maximum file size,
|           which can be tested. If a mail (with header) is larger,
|           it is not checked (by default 500000).
|  
|  This scanner scans for spams. If a spam is returned, a string
|  SPAM is returned as virus name.
|  

Help on module qsf:

class qsf(avlib.ascanner)
|  Quick Spam Filter scanner
|  
|  Usage: qsf(['/usr/bin/qsf','-r'],SPAMSTRING,MAX_FILE_SIZE)
|  
|  Where: in [] is a path and argumets of qsf binary
|         SPAMSTRING is a string, which define a report string,
|           which is checked. If it is found, mail is assigned as 'SPAM'
|         MAX_FILE_SIZE is a number, which defines maximum file size,
|           which can be tested. If a mail (with header) is larger,
|           it is not checked (by default 500000).
|  
|  This scanner scans for spams. If a spam is returned, a string
|  SPAM is returned as virus name. It uses Quick Spam Filter.
|  

Help on class status in module stats:

class status(interscan.match.match_any)
|  status() interscanner
|  
|  Usage: status("String",scanner1(),scanner2(),...)
|  
|  Where: "String" is a string, which defines a prefix for status update
|         scanner1(),... are sagator's scanners
|  
|  This interscanner can be used to collect some other statistics.
|  Preffered usage:
|    SCANNERS=[
|      status("Virus",virus_scanner1(),...),
|      status("Spam",spam_scanner1(),...)
|    ]
|  This collects Virus-count,Virus-bytes,Spam-count,Spam-bytes in collector.
|  

