| 28e73e95 |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<!--Converted with LaTeX2HTML 2K.1beta (1.48)
original version by: Nikos Drakos, CBLU, University of Leeds
* revised and updated by: Marcus Hennecke, Ross Moore, Herb Swan
* with significant contributions from:
Jens Lippmann, Marek Rouchal, Martin Wilck and others -->
<HTML>
<HEAD> |
| 5def21ff |
<TITLE>Archives and compressed files</TITLE>
<META NAME="description" CONTENT="Archives and compressed files"> |
| 28e73e95 |
<META NAME="keywords" CONTENT="clamdoc">
<META NAME="resource-type" CONTENT="document">
<META NAME="distribution" CONTENT="global">
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="LaTeX2HTML v2K.1beta">
<META HTTP-EQUIV="Content-Style-Type" CONTENT="text/css">
<LINK REL="STYLESHEET" HREF="clamdoc.css">
<LINK REL="next" HREF="node19.html">
<LINK REL="previous" HREF="node17.html"> |
| 5def21ff |
<LINK REL="up" HREF="node15.html"> |
| 28e73e95 |
<LINK REL="next" HREF="node19.html">
</HEAD>
<BODY >
<!--Navigation Panel--> |
| 5def21ff |
<A NAME="tex2html394" |
| 28e73e95 |
HREF="node19.html">
<IMG WIDTH="37" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="next"
SRC="/usr/share/latex2html/icons/next.png"></A> |
| 5def21ff |
<A NAME="tex2html390"
HREF="node15.html"> |
| 28e73e95 |
<IMG WIDTH="26" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="up"
SRC="/usr/share/latex2html/icons/up.png"></A> |
| 5def21ff |
<A NAME="tex2html384" |
| 28e73e95 |
HREF="node17.html">
<IMG WIDTH="63" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="previous"
SRC="/usr/share/latex2html/icons/prev.png"></A> |
| 5def21ff |
<A NAME="tex2html392" |
| 28e73e95 |
HREF="node1.html">
<IMG WIDTH="65" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="contents"
SRC="/usr/share/latex2html/icons/contents.png"></A>
<BR> |
| 5def21ff |
<B> Next:</B> <A NAME="tex2html395"
HREF="node19.html">Output format</A>
<B> Up:</B> <A NAME="tex2html391"
HREF="node15.html">Usage</A>
<B> Previous:</B> <A NAME="tex2html385"
HREF="node17.html">Clamuko</A>
  <B> <A NAME="tex2html393" |
| 28e73e95 |
HREF="node1.html">Contents</A></B>
<BR>
<BR>
<!--End of Navigation Panel-->
|
| 5def21ff |
<H2><A NAME="SECTION00043000000000000000">
Archives and compressed files</A> |
| 28e73e95 |
</H2> |
| 5def21ff |
All the scanners depend on LibClamAV. It has a built-in support for the
following formats: |
| 28e73e95 |
<UL> |
| 5def21ff |
<LI>Zip
</LI>
<LI>Gzip |
| 28e73e95 |
</LI> |
| 5def21ff |
<LI>Bzip2
</LI>
<LI>RAR (2.0 only) |
| 28e73e95 |
</LI>
</UL> |
| 5def21ff |
Archive file types are determined by magic number tests.<A NAME="tex2html25"
HREF="footnode.html#foot278"><SUP>5</SUP></A> You need the zlib library
for the Zip/Gzip support. Zip archives are accessed with the zziplib
library by Guido Draheim and Tomi Ollila. RAR support is based on the
UniquE RAR File Library by Christian Scheurer and Johannes Winkelmann.
Both of them are included and slightly modified in the clamav sources.
Unrarlib supports RAR 2.0 archives only and according to Christian
the new format (introduced in WinRAR 3.0) will never be supported
(however clamscan can scan WinRAR 3.0 archives, see below). Due to
security reasons clamd only scans archives supported by libclamav.
Clamscan is more clever and it can also use external unpackers - this
is especially useful when the built-in decompresor fails: |
| 28e73e95 |
<PRE> |
| 5def21ff |
$ clamscan --unrar rarfail.rar
/home/zolw/Clam/test/rarfail.rar: RAR module failure.
UNRAR 3.00 freeware Copyright (c) 1993-2002 Eugene Roshal
Extracting from /home/zolw/Clam/test/rarfail.rar
Extracting test1 OK
All OK
/tmp/44694f5b2665d2f4/test1: ClamAV-Test-Signature FOUND
/home/zolw/Clam/test/rarfail.rar: Infected Archive FOUND |
| 28e73e95 |
</PRE> |
| 5def21ff |
<I><B>TIP:</B> You can force clamscan to list all infected files
in archive using -disable-archive (it disables the built-in decompressors)
and -unzip -unrar...</I>.
<BR>
clamscan supports many popular compressors - it uses external programs
for each format. <B>If the scanner runs with superuser privileges
unpackers are executed with a <I>clamav</I> privileges what makes the
process far more secure.</B> It also cares <I>clamav</I> user has read access
to all files. <B>You must enable recursive scanning with the <I>-r</I>
option (<I>-recursive</I>), if you want to scan a whole content of an
archive (including subdirectories)</B>, this option is also (usually) required
for scanning nested archive. External unpackers supported:
<BR>
<P> |
| 28e73e95 |
|
| 5def21ff |
<B>-unzip: </B> Usually you don't need this option because Zip format is
supported by libclamav. However it may be useful if libclamav
fails to unzip some file. clamscan was tested with
<I>UnZip 5.41 of 16 April 2000, by Info-ZIP</I>.
<BR> <B>-unrar: </B> Tested with <I>UNRAR 3.00 freeware</I>.
<BR> <B>-unace: </B> It uses an options supported by <I>UNACE v1.2 public version</I>,
not tested, but should work.
<BR> <B>-arj: </B> Tested with <I>arj 3.10b</I>.
<BR> <B>-zoo: </B> Tested with <I>zoo 2.1</I>.
<BR> <B>-lha: </B> Tested with <I>LHa for Unix V 1.14e</I>.
<BR> <B>-jar: </B> clamscan uses <I>unzip</I> for .jar files. Tested with
<I>UnZip 5.41 of 16 April 2000, by Info-ZIP</I>.
<BR> <B>-tar: </B> This option enables support for non-compressed archives. Tested
with <I>GNU tar 1.13.17</I>.
<BR> <B>-deb: </B> This option enables support for debian binary packages. Tested with
<I>GNU ar
<BR>
2.12.90.0.14</I>. Implies -tgz , but doesn't conflict
with -tgz=FULLPATH.
<BR> <B>-tgz: </B> This option supports .tar.gz and .tgz files. You need <I>GNU
tar</I>, on non-Linux system you probably have it installed as
<I>gtar</I> and if it can be found in <I>$PATH</I> please use
<I>-tgz=gtar</I> to tell clamscan to use <I>gtar</I> instead of
<I>tar</I>. Otherwise please supply a full path with <I>-tgz</I>.
<BR> |
| 28e73e95 |
<P>
<HR>
<!--Navigation Panel--> |
| 5def21ff |
<A NAME="tex2html394" |
| 28e73e95 |
HREF="node19.html">
<IMG WIDTH="37" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="next"
SRC="/usr/share/latex2html/icons/next.png"></A> |
| 5def21ff |
<A NAME="tex2html390"
HREF="node15.html"> |
| 28e73e95 |
<IMG WIDTH="26" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="up"
SRC="/usr/share/latex2html/icons/up.png"></A> |
| 5def21ff |
<A NAME="tex2html384" |
| 28e73e95 |
HREF="node17.html">
<IMG WIDTH="63" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="previous"
SRC="/usr/share/latex2html/icons/prev.png"></A> |
| 5def21ff |
<A NAME="tex2html392" |
| 28e73e95 |
HREF="node1.html">
<IMG WIDTH="65" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="contents"
SRC="/usr/share/latex2html/icons/contents.png"></A>
<BR> |
| 5def21ff |
<B> Next:</B> <A NAME="tex2html395"
HREF="node19.html">Output format</A>
<B> Up:</B> <A NAME="tex2html391"
HREF="node15.html">Usage</A>
<B> Previous:</B> <A NAME="tex2html385"
HREF="node17.html">Clamuko</A>
  <B> <A NAME="tex2html393" |
| 28e73e95 |
HREF="node1.html">Contents</A></B>
<!--End of Navigation Panel-->
<ADDRESS>
Tomasz Kojm |
| 5def21ff |
2003-11-11 |
| 28e73e95 |
</ADDRESS>
</BODY>
</HTML> |