Advanced Threat Protection

 View Only

Symantec Endpoint Protection doscan

  • 1.  Symantec Endpoint Protection doscan

    Posted Mar 26, 2020 01:58 PM
    Hi, first of all I hope to be in the right discussion group, if not please give me indication about the right discussion group.

    I'm working to a website with a form where the user can upload a file.
    I have to implement in a .net application (c# language) a method that performs a realtime scan of the files uploaded on the website.

    This is my code:
    ------------------------------------------------------------------------------------------------------------------------------------------------

    Process p;
    foreach (MultipartFileData fileData in Listfiles)
    {
    _localFileName = fileData.LocalFileName;
    p = new Process();

    string exefileName = "\"C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\DoScan.exe\""; 

    ProcessStartInfo processInfo = new ProcessStartInfo(exefileName);
    processInfo.UseShellExecute = false;

    processInfo.Arguments = "/ScanFile \"" + _localFileName + "\"";

    p.StartInfo = processInfo;

    p.Start();

    p.WaitForExit(); 

    int exitCode = -1;

    if (p.WaitForExit(200))
    {
    exitCode = p.ExitCode;
    }

    if (exitCode == 0) //Success
    {
    .....
    }
    else if (exitCode == 3) //Infected
    {
    ......
    }
    else // if ((exitCode == 1) || (exitCode == 2) || (exitCode == 4)) //Invalid command line argument || Antivirus scan was completed with errors || Antivirus scan was canceled
    {
    ....
    }

    p.Close();

    }
    -----------------------------------------------------------------------------------------------------------------------------------------------------------------

    The exitCode i get is always 0, also il the file is a test virus (non real dangerous file, that is detected as a virus by the Symantec Endopoint protection, tryed this on my pc).

    My doubt is that i have something wrong in my code (possibly the processInfo.Arguments value) or that the exitcode values legend i am referring to is not correct :
    exitCode == 0 // Success
    exitCode == 3 // Infected

    exitCode == 1 // Invalid command line argument
    exitCode == 2 // Antivirus scan was completed with errors
    exitCode == 4 // Antivirus scan was canceled

    Could someone help me?
    Thank you in advance

    Ivana