threats
[<action> <object>]

Purpose: Apply the specified action to earlier detected threats according to their identifiers. A type of the action is specified by the command option.

If the action is not specified, displays information about detected but not neutralized threats. The information about threats is displayed according the format, specified using the non-mandatory --Format option. If the --Format option is not specified, the following information is displayed for each threat:

•an identifier assigned to the threat (its ordinal number);

•the full path to the infected file;

•information about the threat (its name and type according to the classification of the Doctor Web company);

•information about the file: its size, owner, time of last modification;

•history of operations applied to an infected file: detection, applied actions and so on.

Arguments: None.

Options

--Format "<format string>"—output information about threats in the specified format. The description of the format string is below.

-f [--Follow]—wait for new messages about new threats and display them once they are received (CTRL+C interrupts the waiting).

--Cure <threat list>—attempt to cure the listed threats (threat identifiers are comma-separated);

--Quarantine <threat list>—quarantine the listed threats (threat identifiers are comma-separated);

--Delete <threat list>—delete the listed threats (threat identifiers are comma-separated);

--Ignore <threat list>—ignore the listed threats (threat identifiers are comma-separated).

If you need to apply the action to all detected threats, specify All instead of <threat list>. For example, the command:

quarantines all detected malicious objects.

--Directory <list of directories>—output only threats detected in files in directories from <list of directories>.

quarantine
[<action> <object>]

Purpose: Apply an action to the specified object in quarantine.

If the action is not specified, information about quarantined objects and their identifiers together with brief information about original files put in quarantine is displayed. Information about isolated objects is output according to a format specified with the optional --Format parameter. If the --Format parameter is not specified, the following information is output for every isolated (quarantined) object:

•an identifier assigned to a quarantined object;

•the original path to the file that was moved to quarantine;

•the date of putting the file in quarantine;

•information about the file: its size, owner, time of last modification;

•information about the threat (name of the threat, threat type according to the classification used by the Doctor Web company).

Arguments: None.

Options

--Format "<format string>"—display information about quarantined objects in the specified format. The description of format string is below.

-f [--Follow]—wait for new messages about new threats and display them once they are received (CTRL+C interrupts the waiting).

-a [--Autonomous]—run a standalone instance of the Dr.Web File Checker file scanning component to perform the specified quarantine action and shut down the component upon completion.

This option can be used together with any options mentioned below.

--Discovery [<list of directories>,] searches for quarantine directories in the specified list of directories and add them to the consolidated quarantine upon detecting a threat. If the <list of directories> is not specified, search for quarantine directories in the common locations of the file system (volume mounting points and user home directories).

This option can be specified not only with the -a (--Autonomous) option (see above), but also with any options/actions listed below. Moreover, if the quarantine command is run in standalone instance mode, that is, with the -a (--Autonomous) option but without the --Discovery option, then it has the same effect as calling:

--Delete <object>—delete the specified quarantined object.

--Restore <object>—restore the specified object from the quarantine to its original location.

--Cure <object>—attempt to cure the specified object in the quarantine.

--TargetPath <path>—restore an object from quarantine to the specified location: either as a file with the specified name (if <path> is a path to a file), or to the specified directory (if <path> is a path to a directory). A path can be absolute or relative (with regard to the current directory).

As an <object>, specify the object identifier in quarantine. To apply the action to all quarantined objects, specify All instead of <object>. For example, the command

restores all quarantined objects and puts them in the test subdirectory located in the current directory from which the drweb-ctl command was run.

%{n}

New line

%{t}

Tabulation

%{threat_name}

The name of the detected threat according to the classification of the Doctor Web company

%{threat_type}

Threat type (“known virus” and so on) according to Doctor Web classification

%{size}

Original file size

%{origin}

The full name of the original file with path

%{path}

Synonym of %{origin}

%{ctime}

Modification date/time of the original file in "%Y-%b-%d %H:%M:%S" format (for example, "2018-Jul-20 15:58:01")

%{timestamp}

Similar to %{ctime}, but in the Unix timestamp format

%{owner}

The original file owner

%{rowner}

The remote owner of the original file (if not applicable or value is unknown it is replaced with ?)

%{hid}

The identifier of the threat record in the history of events associated with the threat

%{tid}

Threat identifier

%{htime}

Date/time of the event related to the threat

%{app}

The identifier of the Dr.Web Server Security Suite component which processed a threat

%{event}

The latest event related to a threat:

•FOUND—threat was detected;

•CURE—threat was cured;

•QUARANTINE—file with a threat was quarantined;

•DELETE—file with a threat was deleted;

•IGNORE—threat was ignored;

•RECAPTURED—threat was detected by another component

%{err}

Error message text (if no error has occurred, the text is replaced with an empty string)

%{qid}

The identifier of the quarantined object

%{qtime}

Date/time of moving the object to quarantine

%{curetime}

Date/time of curing attempt of the quarantined object (if not applicable or the value is unknown, it is replaced with ?)

%{cureres}

The result of the quarantined object curing attempt:

•cured—threat was cured;

•not cured—threat was not cured or no curing attempts were made