Input
VGrep accepts a text-string to search for within its database. Normally this is assumed to be a sub-string, but with both the web version and the downloadable DOS EXE you may also specify that the string must match exactly.
Additionally, with both versions you are able to select a specific product whose virus names you wish to match. All searching is case-insensitive.
It is also possible to specify where a substring should match. ^ and $ have their standard regex meanings: ^ matches the beginning of a string, and $ the end. For example, ':mte$' would match any names ending in ':mte' and '^form' would match any names starting with 'form'.
Neither 'abc^d' nor 'efg$h' would match anything, by definition.
Output
The web version of VGrep provides a tidier output than the DOS EXE.
The following conventions should be noted:
- '~' (DOS version) or '[maybe]' (web version) in front of a name indicates that the product in question determined a file is 'possibly infected' or 'infected with a variant of'.
- 'NO_VIRUS' (DOS version) or '[undetected]' (web version) indicates that the product did not recognize when a file was infected with this virus.
Multiple records are often produced when people search for what they believe to be a completely specific name - for example, the name 'Form' is not enough to completely specify a virus. There are several strains of Form, but some products will identify them all as Form, or identify the first merely as Form, and then add modifiers for the rest (e.g. Form.b etc). This is perfectly normal. However, you can push this to extremes by searching on single characters - 'e' produces many thousands of output lines, and will take a correspondingly long time.
More details:
