User guide

82
5.7.5.1 Using ESET SysRescue
Suppose that computers in the network have been infected by a virus which modifies executable (.exe) files. ESET
Security solution is capable of cleaning all infected files except for explorer.exe, which cannot be cleaned, even in Safe
mode. This is because explorer.exe, as one of the essential Windows processes, is launched in Safe mode as well. ESET
Security solution would not be able to perform any action with the file and it would remain infected.
In this type of scenario, you could use ESET SysRescue to solve the problem. ESET SysRescue does not require any
component of the host operating system, and is therefore capable of processing (cleaning, deleting) any file on the disk.
5.8 Command Line
ESET NOD32 Antivirus's antivirus module can be launched via the command line – manually (with the “ecls” command)
or with a batch (“bat”) file. ESET Command-line scanner usage:
ecls [OPTIONS..] FILES..
The following parameters and switches can be used while running the on-demand scanner from the command line:
Options
/base-dir=FOLDER
load modules from FOLDER
/quar-dir=FOLDER
quarantine FOLDER
/exclude=MASK
exclude files matching MASK from scanning
/subdir
scan subfolders (default)
/no-subdir
do not scan subfolders
/max-subdir-level=LEVEL
maximum sub-level of folders within folders to scan
/symlink
follow symbolic links (default)
/no-symlink
skip symbolic links
/ads
scan ADS (default)
/no-ads
do not scan ADS
/log-file=FILE
log output to FILE
/log-rewrite
overwrite output file (default – append)
/log-console
log output to console (default)
/no-log-console
do not log output to console
/log-all
also log clean files
/no-log-all
do not log clean files (default)
/aind
show activity indicator
/auto
scan and automatically clean all local disks
Scanner options
/files
scan files (default)
/no-files
do not scan files
/memory
scan memory
/boots
scan boot sectors
/no-boots
do not scan boot sectors (default)
/arch
scan archives (default)
/no-arch
do not scan archives
/max-obj-size=SIZE
only scan files smaller than SIZE megabytes (default 0 = unlimited)
/max-arch-level=LEVEL
maximum sub-level of archives within archives (nested archives) to scan
/scan-timeout=LIMIT
scan archives for LIMIT seconds at maximum
/max-arch-size=SIZE
only scan the files in an archive if they are smaller than SIZE (default 0 = unlimited)
/max-sfx-size=SIZE
only scan the files in a self-extracting archive if they are smaller than SIZE megabytes
(default 0 = unlimited)
/mail
scan email files (default)
/no-mail
do not scan email files
/mailbox
scan mailboxes (default)
/no-mailbox
do not scan mailboxes
/sfx
scan self-extracting archives (default)
/no-sfx
do not scan self-extracting archives
/rtp
scan runtime packers (default)
/no-rtp
do not scan runtime packers
/adware
scan for Adware/Spyware/Riskware (default)
/no-adware
do not scan for Adware/Spyware/Riskware
/unsafe
scan for potentially unsafe applications