Kaspersky Industrial CyberSecurity for Nodes

Running Portable Scanner via command line

August 3, 2023

ID 235347

You can start only a Portable Scanner written to a source removable drive connected via USB. If you copy the Portable scanner to a different USB drive, you will not be able to run it.

To run the Portable scanner:

  1. On the device, run a command line interpreter (for example, Command Prompt cmd.exe) with the permissions of the local administrator.
  2. Using the cd command, navigate to the folder where the kavscan.exe file is located.

    For example, you can type the following command cd "[drive]:\Kavscan" and press Enter.

  3. Run one the following commands as applicable and press Enter:

    kavscan.exe help

    kavscan.exe scan [/mycomputer] [/fixed] [/removable] [/remote] [/shared] [/memory] [/startup] [/drive=<drive>] [/folder=<folder_name_for_scan>] [/file=<file_name>] [/trace] [/dump] [/report=<type>] [/cure={yes|no}] [/settings=<full_path_to_custom_settings_file>]

    kavscan.exe update [/source=<folder_name_for_database_updates>]

    Setting

    Description

    <mode>

    Defines the mode of the Portable Scanner.
    Available values are:

    help—use this mode to call help and learn more about available options.

    scan — use this mode to scan the selected scope on the device.

    update — use this option to update the anti-virus databases.

    If the value is not set, the Portable Scanner fails to start and returns the following notification: "The mode is not set. Run the "kavscan.exe help" command to bring up the help for reference.

    /mycomputer

    Starts scanning the entire computer.

    /fixed

    Starts scanning all fixed drives.

    /removable

    Starts scanning all removable drives.

    /remote

    Starts scanning all remote drives.

    /shared

    Starts scanning the shared folders.

    /memory

    Starts scanning all memory processes.

    /startup

    Starts scanning the startup objects.

    /drive=<drive>

    Starts scanning all boot sectors and files on the specified drive.

    /folder=<folder_name_for_scan>

    Starts scanning the specified folder.

    You cannot use a folder label template as a value for the parameter.

    /file=<file_name>

    Starts scanning the specified file.

    /trace

    Enables tracing.

    /dump

    Enables dump recording.

    /report=<type>

    Defines the type of a report to return. The following values are available:
    full—full report for scanning with all types of events.

    critical—report for scanning only with critical type of events.

    short—report for scanning containing general statistics, without events. By default, the short type is applied.

    /cure={yes|no}

    Defines the scanning mode. The following values are available:

    yes—scanning with further disinfection. If the parameter is not set, the mode configured in settings is applied.

    no—scanning in the detection mode. If the parameter is not set, the mode configured in settings is applied.

    /settings=<full_path_to_customs_settings_file>

    Applies custom settings from the <full_path_to_custom_settings_file>.

    If the value is not set, the scanner applies the default settings from the <program_path>\Settings.dat file.

    /source=<folder_name_for_database_updates>

    Defines the source where the Portable Scanner takes the updates in the update mode.

    If the value is not set, the update fails.

Return codes of the kavscan.exe scan command:

  • 0

    —command successfully executed.
  • 1

    —general error.

If the command completes successfully (code 

0

), a report in the kics_report_ <scanned_device_name>_<date_time>.txt format will be available in the Kavscan folder.

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.