Available Scan Results (scan_result_i, scan_all_result_i)
value |
short description |
long description |
0 |
No Threats Found |
No threat detection or the file is empty |
1 |
Infected/Known |
Threat is found |
2 |
Suspicious |
Classified as possible threat but not identified as specific threat. |
3 |
Failed To Scan |
Scanning is not fully performed (For example, invalid file or no read permission). If no engine is included and scan is enabled, this will be the final result. |
4 |
Cleaned / Deleted |
Threat is found and file is cleaned (repaired or deleted): repair is not supported yet |
5 |
Unknown |
Unknown signature. NOTE: this is only used in multiple hash lookup. For single hash lookup, scan_result_* are not returned as response. see Retrieve scan report by hash (duplicate) for more details. |
6 |
Quarantined |
File is quarantined |
7 |
Skipped Clean |
Scan is skipped because this file type is in white-list* |
8 |
Skipped Infected |
Scan is skipped because this file type is in black-list* |
9 |
Exceeded Archive Depth |
Threat is not found but there are more archive levels which were not extracted. |
10 |
Not Scanned / No scan results |
Scan is skipped by the engine either due to update or other engine specific reason. If scan is disabled, this will be the final result. |
11 |
Aborted |
All ongoing scans are purged |
12 |
Encrypted |
File/buffer is not scanned because the file type is detected as encrypted (password-protected). If the Internal Archive Library is ON encrypted return type is not going to be returned through Metascan scan progress callbacks since the engines do not perform any scan operations. If the Internal Archive Library is OFF Metascan will pass the encrypted files to the engines directly, bypassing the detection. |
13 |
Exceeded Archive Size |
The extracted archive is too large to scan |
14 |
Exceeded Archive File Number |
There are more files in the archive than configured on the server |
15 |
Password Protected Document |
Document that is protected by a password [e.g. Office documents or PDFs that require a password to view its contents] |
16 |
Exceeded Archive Timeout |
The archive process reached the given timeout value. This result is supported from Core version 4.4.0. |
Scan is not carried out
If scanning is disabled or skipped, a scan_results object will be generated with the following values.
3.11.2 and newer:
scan_results.scan_all_result_i = 10
scan_results.scan_all_result_a = "Not Scanned"
3.11.0 & 3.11.1:
scan_results.scan_all_result_i = -1
scan_results.scan_all_result_a = ""
older than 3.11.0:
scan_results.scan_all_result_i = 1000
scan_results.scan_all_result_a = "No Scan Result"
Scan partially completed
Accumulated result at the time scan result was queried.
This is same as other Metascan interface such as COM interface and Java interface.