1clamscan(1) Clam AntiVirus clamscan(1)
2
6 clamscan - scan files and directories for viruses
7
9 clamscan [options] [file/directory/-]
10
12 clamscan is a command line anti-virus scanner.
13
15 -h, --help
16 Print help information and exit.
17 -V, --version
19 Print version number and exit.
20 -v, --verbose
22 Be verbose.
23 --debug
25 Display debug messages from libclamav.
26 --quiet
28 Be quiet (only print error messages).
29 --stdout
31 Write all messages (except for libclamav output) to the standard
32 output (stdout).
33 -d FILE/DIR, --database=FILE/DIR
35 Load virus database from FILE or load all virus database files
36 from DIR.
37 -l FILE, --log=FILE
39 Save scan report to FILE.
40 --tempdir=DIRECTORY
42 Create temporary files in DIRECTORY. Directory must be writable
43 for the '' user or unprivileged user running clamscan.
44 --leave-temps
46 Do not remove temporary files.
47 -r, --recursive
49 Scan directories recursively. All the subdirectories in the
50 given directory will be scanned.
51 --bell Sound bell on virus detection.
53 --no-summary
55 Do not display summary at the end of scanning.
56 --exclude=PATT, --exclude-dir=PATT
58 Don't scan file/directory names containing PATT. It may be used
59 multiple times.
60 --include=PATT, --include-dir=PATT
62 Only scan file/directory names containing PATT. It may be used
63 multiple times.
64 -i, --infected
66 Only print infected files.
67 --remove
69 Remove infected files. Be careful.
70 --move=DIRECTORY
72 Move infected files into DIRECTORY. Directory must be writable
73 for the '' user or unprivileged user running clamscan.
74 --copy=DIRECTORY
76 Copy infected files into DIRECTORY. Directory must be writable
77 for the '' user or unprivileged user running clamscan.
78 --detect-pua
80 Detect Possibly Unwanted Applications.
81 --no-mail
83 Disable scanning of mail files.
84 --no-phishing-sigs
86 Disable signature-based phishing detection.
87 --no-phishing-scan-urls
89 Disable url-based heuristic phishing detection. This disables
90 Phishing.Heuristics.Email.*
91 --no-phishing-restrictedscan
93 Enable url-based heuristic phishing detection for all domains
94 (might lead to false positives!).
95 --phishing-ssl
97 Always block SSL mismatches in URLs (might lead to false posi‐
98 tives!).
99 --phishing-cloak
101 Always block cloaked URLs (might lead to some false positives).
102 --no-algorithmic
104 In some cases (eg. complex malware, exploits in graphic files,
105 and others), ClamAV uses special algorithms to provide accurate
106 detection. This option disables the algorithmic detection.
107 --no-pe
109 PE stands for Portable Executable - it's an executable file for‐
110 mat used in all 32-bit versions of Windows operating systems. By
111 default ClamAV performs deeper analysis of executable files and
112 attempts to decompress popular executable packers such as UPX,
113 Petite, and FSG. This option disables PE support and should be
114 used with care!
115 --no-elf
117 Executable and Linking Format is a standard format for UN*X exe‐
118 cutables. This option disables ELF support.
119 --no-ole2
121 Disable support for Microsoft Office documents and .msi files.
122 --no-pdf
124 Disable scanning within PDF files.
125 --no-html
127 Disable support for HTML detection and normalisation.
128 --no-archive
130 Disable archive support built in libclamav.
131 --detect-broken
133 Mark broken executables as viruses (Broken.Executable).
134 --block-encrypted
136 Mark encrypted archives as viruses (Encrypted.Zip,
137 Encrypted.RAR).
138 --block-max
140 Mark archives as viruses (e.g. RAR.ExceededFileSize, Zip.Exceed‐
141 edFilesLimit) if max-files, max-space, or max-recursion is
142 reached.
143 --mail-follow-urls
145 If an email contains URLs ClamAV can download and scan them.
146 WARNING: This option may open your system to a DoS attack. Never
147 use it on loaded servers.
148 --max-files=#n
150 Extract first #n files from each archive. This option protects
151 your system against DoS attacks (default: 500)
152 --max-space=#n
154 Extract first #n kilobytes from each archive. You may pass the
155 value in megabytes in format xM or xm, where x is a number. This
156 option protects your system against DoS attacks (default: 10 MB)
157 --max-recursion=#n
159 Set archive recursion level limit. This option protects your
160 system against DoS attacks (default: 8).
161 --max-ratio=#n
163 Set maximum archive compression ratio limit. This option pro‐
164 tects your system against DoS attacks (default: 250).
165 --max-mail-recursion=#n
167 Recursion level limit for the internal mail scanner.
168 --max-dir-recursion=#n
170 Maximum depth directories are scanned at (default: 15).
171 --unzip[=FULLPATH]
173 In most cases you don't need this option - the built-in unar‐
174 chiver will extract Zip archives. Howvere, this option may be
175 used as a backup for internal unpacker - see the full documenta‐
176 tion for more information. When enabled without an argument,
177 unzip program will be searched in $PATH. If unzip cannot be
178 found in $PATH, you must force it with =pathname. Remember about
179 '=' between the option and the argument.
180 --unrar[=FULLPATH]
182 Scan .rar files. In most cases the unpacker built into libclamav
183 is enough.
184 --arj[=FULLPATH]
186 Scan .arj files.
187 --unzoo[=FULLPATH]
189 Scan .zoo files.
190 --lha[=FULLPATH]
192 Scan .lzh files.
193 --jar[=FULLPATH]
195 clamscan uses unzip for .jar files, so in some cases you may
196 need to pass a full path to unzip. In most cases the unpacker
197 built into libclamav is enough.
198 --deb[=FULLPATH]
200 This option supports debian binary packages. Implies --tgz, but
201 doesn't conflict with --tgz=FULLPATH. It requires ar utility.
202 --tar[=FULLPATH]
204 This option supports non-compressed tar archives. In most cases
205 the unpacker built into libclamav is enough.
206 --tgz[=FULLPATH]
208 This option supports tar.gz and .tgz files. You need GNU tar, on
209 non-Linux system you probably have it installed as gtar. If it's
210 in $PATH, please use --tgz=gtar in other case please pass a full
211 path. In most cases the unpacker built into libclamav is enough.
212
214 (0) Scan a single file:
215 clamscan file
217 (1) Scan a current working directory:
219 clamscan
221 (2) Scan all files (and subdirectories) in /home:
223 clamscan -r /home
225 (3) Load database from a file and limit disk usage to 50 MB:
227 clamscan -d /tmp/newclamdb --max-space=50m -r /tmp
229 (4) Scan a data stream:
231 cat testfile | clamscan -
233 (5) Scan a mail spool directory:
235 clamscan -r /var/spool/mail
237
239 Note: some return codes may only appear in a single file mode (when
240 clamscan is started with a single argument). Those are marked with
241 (ofm).
242 0 : No virus found.
244 1 : Virus(es) found.
246 40: Unknown option passed.
248 50: Database initialization error.
250 52: Not supported file type.
252 53: Can't open directory.
254 54: Can't open file. (ofm)
256 55: Error reading file. (ofm)
258 56: Can't stat input file / directory.
260 57: Can't get absolute path name of current working directory.
262 58: I/O error, please check your file system.
264 59: Can't get information about current user from /etc/passwd.
266 60: Can't get information about user '' from /etc/passwd.
268 61: Can't fork.
270 62: Can't initialize logger.
272 63: Can't create temporary files/directories (check permissions).
274 64: Can't write to temporary directory (please specify another one).
276 70: Can't allocate memory (calloc).
278 71: Can't allocate memory (malloc).
280
282 Please check the full documentation for credits.
283
285 Tomasz Kojm <tkojm@clamav.net>
286
288 clamdscan(1), freshclam(1)
289ClamAV 0.92.1 February 12, 2007 clamscan(1)