DrWeb?

daemonized scanner

### http://www.sald.com/, http://www.dials.ru/english/, http://www.drweb.ru/
['DrWebD', \&ask_daemon,   # DrWebD 4.31 or later
  [pack('N',1).  # DRWEBD_SCAN_CMD
   pack('N',0x00280001).   # DONT_CHANGEMAIL, IS_MAIL, RETURN_VIRUSES
   pack('N',     # path length
     length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")).
   '{}/*'.       # path
   pack('N',0).  # content size
   pack('N',0),
   '/var/drweb/run/drwebd.sock',
 # '/var/amavis/var/run/drwebd.sock',   # suitable for chroot
 # '/usr/local/drweb/run/drwebd.sock',  # FreeBSD drweb ports default
 # '127.0.0.1:3000',                    # or over an inet socket
  ],
  qr/\A\x00[\x10\x11][\x00\x10]\x00/s,         # IS_CLEAN,EVAL_KEY; SKIPPED
  qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/s, # KNOWN_V,UNKNOWN_V,V._MODIF
  qr/\A.{12}(?:infected with )?([^\x00]+)\x00/s,
],

command-line scanner

### http://www.sald.com/, http://drweb.imshop.de/   - backs up DrWebD
['drweb - DrWeb Antivirus',
  ['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'],
  '-path={} -al -go -ot -cn -upn -ok-',
  [0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'],