Available Scan Results (scan_result_i, scan_all_result_i)

value

short description

long description

0

No Threats Found

No threat detection or the file is empty

1

Infected/Known

Threat is found

2

Suspicious

Classified as possible threat but not identified as specific threat.

3

Failed To Scan

Scanning is not fully performed (For example, invalid file or no read permission). If no engine is included and scan is enabled, this will be the final result.

4

Cleaned / Deleted

Threat is found and file is cleaned (repaired or deleted): repair is not supported yet

5

Unknown

Unknown signature. NOTE: this is only used in multiple hash lookup. For single hash lookup, scan_result_* are not returned as response. see Retrieve scan report by hash (duplicate) for more details.

6

Quarantined

File is quarantined

7

Skipped Clean

Scan is skipped because this file type is in white-list*

8

Skipped Infected

Scan is skipped because this file type is in black-list*

9

Exceeded Archive Depth

Threat is not found but there are more archive levels which were not extracted.

10

Not Scanned / No scan results

Scan is skipped by the engine either due to update or other engine specific reason. If scan is disabled, this will be the final result.

11

Aborted

All ongoing scans are purged

12

Encrypted

File/buffer is not scanned because the file type is detected as encrypted (password-protected). If the Internal Archive Library is ON encrypted return type is not going to be returned through Metascan scan progress callbacks since the engines do not perform any scan operations. If the Internal Archive Library is OFF Metascan will pass the encrypted files to the engines directly, bypassing the detection.

13

Exceeded Archive Size

The extracted archive is too large to scan

14

Exceeded Archive File Number

There are more files in the archive than configured on the server

15

Password Protected Document

Document that is protected by a password [e.g. Office documents or PDFs that require a password to view its contents]

16

Exceeded Archive Timeout

The archive process reached the given timeout value. This result is supported from Core version 4.4.0.

Scan is not carried out

If scanning is disabled or skipped, a scan_results object will be generated with the following values.

3.11.2 and newer:
scan_results.scan_all_result_i = 10
scan_results.scan_all_result_a = "Not Scanned"

3.11.0 & 3.11.1:
scan_results.scan_all_result_i = -1
scan_results.scan_all_result_a = ""

older than 3.11.0:
scan_results.scan_all_result_i = 1000
scan_results.scan_all_result_a = "No Scan Result"

Scan partially completed

Accumulated result at the time scan result was queried.

This is same as other Metascan interface such as COM interface and Java interface.