269d520d |
.TH "clamscan" "1" "December 30, 2008" "ClamAV @VERSION@" "Clam AntiVirus" |
28e73e95 |
.SH "NAME"
.LP |
f3a638e4 |
clamscan \- scan files and directories for viruses |
28e73e95 |
.SH "SYNOPSIS"
.LP
clamscan [options] [file/directory/\-]
.SH "DESCRIPTION"
.LP |
f3a638e4 |
clamscan is a command line anti\-virus scanner. |
28e73e95 |
.SH "OPTIONS"
.LP |
269d520d |
Most of the options are simple switches which enable or disable some features. Options marked with [=yes/no(*)] can be optionally followed by =yes/=no; if they get called without the boolean argument the scanner will assume 'yes'. The asterisk marks the default internal setting for a given option. |
28e73e95 |
.TP
\fB\-h, \-\-help\fR |
a9ebff44 |
Print help information and exit. |
28e73e95 |
.TP
\fB\-V, \-\-version\fR |
a9ebff44 |
Print version number and exit. |
28e73e95 |
.TP
\fB\-v, \-\-verbose\fR |
5def21ff |
Be verbose.
.TP
\fB\-\-debug\fR |
f3a638e4 |
Display debug messages from libclamav. |
28e73e95 |
.TP
\fB\-\-quiet\fR |
a9ebff44 |
Be quiet (only print error messages). |
28e73e95 |
.TP
\fB\-\-stdout\fR |
8589f1a0 |
Write all messages (except for libclamav output) to the standard output (stdout). |
28e73e95 |
.TP
\fB\-d FILE/DIR, \-\-database=FILE/DIR\fR |
a9ebff44 |
Load virus database from FILE or load all virus database files from DIR. |
28e73e95 |
.TP
\fB\-l FILE, \-\-log=FILE\fR |
a9ebff44 |
Save scan report to FILE. |
28e73e95 |
.TP
\fB\-\-tempdir=DIRECTORY\fR |
a39ae468 |
Create temporary files in DIRECTORY. Directory must be writable for the '@CLAMAVUSER@' user or unprivileged user running clamscan. |
28e73e95 |
.TP |
a9082ea2 |
\fB\-\-leave\-temps\fR
Do not remove temporary files.
.TP |
c2b6681b |
\fB\-f FILE, \-\-file\-list=FILE\fR
Scan files listed line by line in FILE.
.TP |
28e73e95 |
\fB\-r, \-\-recursive\fR |
a9ebff44 |
Scan directories recursively. All the subdirectories in the given directory will be scanned. |
28e73e95 |
.TP |
a3ee0766 |
\fB\-\-bell\fR
Sound bell on virus detection.
.TP
\fB\-\-no\-summary\fR |
02b4b0c7 |
Do not display summary at the end of scanning. |
28e73e95 |
.TP |
66ceca09 |
\fB\-\-exclude=PATT, \-\-exclude\-dir=PATT\fR
Don't scan file/directory names containing PATT. It may be used multiple times. |
28e73e95 |
.TP |
66ceca09 |
\fB\-\-include=PATT, \-\-include\-dir=PATT\fR
Only scan file/directory names containing PATT. It may be used multiple times. |
ab16bae7 |
.TP |
28e73e95 |
\fB\-i, \-\-infected\fR |
5def21ff |
Only print infected files. |
28e73e95 |
.TP |
269d520d |
\fB\-\-remove[=yes/no(*)]\fR |
28e73e95 |
Remove infected files. \fBBe careful.\fR |
5def21ff |
.TP |
28e73e95 |
\fB\-\-move=DIRECTORY\fR |
a39ae468 |
Move infected files into DIRECTORY. Directory must be writable for the '@CLAMAVUSER@' user or unprivileged user running clamscan. |
28e73e95 |
.TP |
f3a638e4 |
\fB\-\-copy=DIRECTORY\fR |
a39ae468 |
Copy infected files into DIRECTORY. Directory must be writable for the '@CLAMAVUSER@' user or unprivileged user running clamscan. |
f3a638e4 |
.TP |
269d520d |
\fB\-\-detect\-pua[=yes/no(*)]\fR |
70edb085 |
Detect Possibly Unwanted Applications.
.TP |
c657d4d8 |
\fB\-\-exclude\-pua=CATEGORY\fR |
3c8de8cc |
Exclude a specific PUA category. This option can be used multiple times. See http://www.clamav.net/support/pua for the complete list of PUA |
c657d4d8 |
.TP
\fB\-\-include\-pua=CATEGORY\fR |
3c8de8cc |
Only include a specific PUA category. This option can be used multiple times. See http://www.clamav.net/support/pua for the complete list of PUA |
c657d4d8 |
.TP |
269d520d |
\fB\-\-detect\-structured[=yes/no(*)]\fR
Use the DLP (Data Loss Prevention) module to detect SSN and Credit Card numbers inside documents/text files. |
5fe6e72b |
.TP
\fB\-\-structured\-ssn\-format=X\fR |
3f9918e1 |
X=0: search for valid SSNs formatted as xxx-yy-zzzz (normal); X=1: search for valid SSNs formatted as xxxyyzzzz (stripped); X=2: search for both formats. Default is 0. |
5fe6e72b |
.TP
\fB\-\-structured\-ssn\-count=#n\fR |
57e1a05e |
This option sets the lowest number of Social Security Numbers found in a file to generate a detect (default: 3). |
5fe6e72b |
.TP
\fB\-\-structured\-cc\-count=#n\fR |
57e1a05e |
This option sets the lowest number of Credit Card numbers found in a file to generate a detect (default: 3). |
5fe6e72b |
.TP |
269d520d |
\fB\-\-scan\-mail[=yes(*)/no]\fR
Scan mail files. |
a36e6e5c |
.TP |
269d520d |
\fB\-\-phishing\-sigs[=yes(*)/no]\fR
Use the signature-based phishing detection. |
d6449522 |
.TP |
269d520d |
\fB\-\-phishing\-scan\-urls[=yes(*)/no]\fR
Use the url-based heuristic phishing detection (Phishing.Heuristics.Email.*) |
e9d3861e |
.TP |
269d520d |
\fB\-\-heuristic\-scan\-precedence[=yes/no(*)]\fR |
7f0d1148 |
Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time. When disabled, virus/phish detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phish, and a real malware, the real malware will be reported Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option. |
e9d3861e |
.TP |
269d520d |
\fB\-\-phishing\-ssl[=yes/no(*)]\fR
Block SSL mismatches in URLs (might lead to false positives!). |
19b3e182 |
.TP |
269d520d |
\fB\-\-phishing\-cloak[=yes/no(*)]\fR
Block cloaked URLs (might lead to some false positives). |
19b3e182 |
.TP |
269d520d |
\fB\-\-algorithmic\-detection[=yes(*)/no]\fR
In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option can be used to control the algorithmic detection. |
1b661cef |
.TP |
269d520d |
\fB\-\-scan\-pe[=yes(*)/no]\fR
PE stands for Portable Executable \- it's an executable file format used in all 32\-bit versions of Windows operating systems. By default ClamAV performs deeper analysis of executable files and attempts to decompress popular executable packers such as UPX, Petite, and FSG. |
28e73e95 |
.TP |
269d520d |
\fB\-\-scan\-elf[=yes(*)/no]\fR
Executable and Linking Format is a standard format for UN*X executables. This option controls the ELF support. |
3f97a1e7 |
.TP |
269d520d |
\fB\-\-scan\-ole2[=yes(*)/no]\fR
Scan Microsoft Office documents and .msi files. |
fb787a06 |
.TP |
269d520d |
\fB\-\-scan\-pdf[=yes(*)/no]\fR
Scan within PDF files. |
c5107e70 |
.TP |
269d520d |
\fB\-\-scan\-html[=yes(*)/no]\fR
Detect, normalize/decrypt and scan HTML files and embedded scripts. |
888f5794 |
.TP |
269d520d |
\fB\-\-scan\-archive[=yes(*)/no]\fR
Scan archives supported by libclamav. |
28e73e95 |
.TP |
269d520d |
\fB\-\-detect\-broken[=yes/no(*)]\fR |
20c3d44d |
Mark broken executables as viruses (Broken.Executable).
.TP |
269d520d |
\fB\-\-block\-encrypted[=yes/no(*)]\fR |
fb787a06 |
Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
.TP |
269d520d |
\fB\-\-mail\-follow\-urls[=yes/no(*)]\fR |
a36e6e5c |
If an email contains URLs ClamAV can download and scan them. \fBWARNING: This option may open your system to a DoS attack. Never use it on loaded servers.\fR
.TP |
28e73e95 |
\fB\-\-max\-files=#n\fR |
4fd3c044 |
Extract at most #n files from each scanned file (when this is an archive, a document or another kind of container). This option protects your system against DoS attacks (default: 10000) |
28e73e95 |
.TP |
4fd3c044 |
\fB\-\-max\-filesize=#n\fR |
32ec6344 |
Extract and scan at most #n kilobytes from each archive. You may pass the value in megabytes in format xM or xm, where x is a number. This option protects your system against DoS attacks (default: 25 MB, max: <4 GB) |
28e73e95 |
.TP |
4fd3c044 |
\fB\-\-max\-scansize=#n\fR |
32ec6344 |
Extract and scan at most #n kilobytes from each scanned file. You may pass the value in megabytes in format xM or xm, where x is a number. This option protects your system against DoS attacks (default: 100 MB, max: <4 GB) |
28e73e95 |
.TP |
4fd3c044 |
\fB\-\-max\-recursion=#n\fR
Set archive recursion level limit. This option protects your system against DoS attacks (default: 16). |
467f8b1e |
.TP |
5a29f422 |
\fB\-\-max\-dir\-recursion=#n\fR |
4e38c525 |
Maximum depth directories are scanned at (default: 15). |
28e73e95 |
.SH "EXAMPLES"
.LP
.TP |
f3a638e4 |
(0) Scan a single file: |
28e73e95 |
\fBclamscan file\fR
.TP |
f3a638e4 |
(1) Scan a current working directory: |
28e73e95 |
\fBclamscan\fR
.TP |
5def21ff |
(2) Scan all files (and subdirectories) in /home: |
28e73e95 |
\fBclamscan \-r /home\fR
.TP |
16516d51 |
(3) Load database from a file: |
28e73e95 |
|
16516d51 |
\fBclamscan \-d /tmp/newclamdb \-r /tmp\fR |
28e73e95 |
.TP |
f3a638e4 |
(4) Scan a data stream: |
28e73e95 |
\fBcat testfile | clamscan \-\fR
.TP |
f3a638e4 |
(5) Scan a mail spool directory: |
28e73e95 |
|
9199093c |
\fBclamscan \-r /var/spool/mail\fR |
28e73e95 |
.SH "RETURN CODES"
.LP |
f3a638e4 |
Note: some return codes may only appear in a single file mode (when clamscan is started with a single argument). Those are marked with \fB(ofm)\fR. |
28e73e95 |
0 : No virus found.
.TP
1 : Virus(es) found.
.TP
40: Unknown option passed.
.TP |
5def21ff |
50: Database initialization error. |
28e73e95 |
.TP
52: Not supported file type.
.TP
53: Can't open directory.
.TP
54: Can't open file. (ofm)
.TP
55: Error reading file. (ofm)
.TP
56: Can't stat input file / directory.
.TP |
a9ebff44 |
57: Can't get absolute path name of current working directory. |
28e73e95 |
.TP |
37526073 |
58: I/O error, please check your file system. |
28e73e95 |
.TP |
932616b1 |
62: Can't initialize logger.
.TP |
28e73e95 |
63: Can't create temporary files/directories (check permissions).
.TP |
a9ebff44 |
64: Can't write to temporary directory (please specify another one). |
28e73e95 |
.TP |
f3a638e4 |
70: Can't allocate memory (calloc). |
28e73e95 |
.TP
71: Can't allocate memory (malloc).
.SH "CREDITS"
Please check the full documentation for credits.
.SH "AUTHOR"
.LP |
5def21ff |
Tomasz Kojm <tkojm@clamav.net> |
28e73e95 |
.SH "SEE ALSO"
.LP |
a9ebff44 |
clamdscan(1), freshclam(1) |