@@ -1,3 +1,7 @@

+Mon Feb 12 13:48:46 CET 2007 (tk)

+---------------------------------

+  * docs: new clamdoc tex/pdf/html

+

 Mon Feb 12 13:12:12 CET 2007 (tk)

 ---------------------------------

   * freshclam/manager.c: don't stick to a broken mirror when downloading cvd

Binary files a/clamav-devel/docs/clamdoc.pdf and b/clamav-devel/docs/clamdoc.pdf differ

@@ -1,6 +1,6 @@

 %  Clam AntiVirus: User Manual

 %

-%  Copyright (C) 2002 - 2005 Tomasz Kojm <tkojm*clamav.net>

+%  Copyright (C) 2002 - 2007 Tomasz Kojm <tkojm*clamav.net>

 %  Version 0.2x corrected by Dennis Leeuw <dleeuw*made-it.com>

 %  Version 0.80 corrected by Tomasz Papszun <tomek*clamav.net>

 %

@@ -70,35 +70,30 @@

     \vspace{3cm}

     \begin{flushright}

 	\rule[-1ex]{8cm}{3pt}\\

-	\huge Clam AntiVirus 0.88.1\\

+	\huge Clam AntiVirus 0.90\\

 	\huge \emph{User Manual}\\

     \end{flushright}

     \newpage

     \pagestyle{fancy}

     \tableofcontents

-    \vspace{9.5cm}

+    \vspace{1.5cm}

     \noindent

     \begin{boxedminipage}[b]{\textwidth}

-    ClamAV User Manual, \copyright \  2002 - 2006 Tomasz Kojm\\

+    ClamAV User Manual, \copyright \  2002 - 2007 Tomasz Kojm\\

     This document is distributed under the terms of the GNU General

-    Public License v2.

-    \end{boxedminipage}

-

-    \vspace{1.0cm}

+    Public License v2.\\

-    \noindent

-    \begin{boxedminipage}[b]{\textwidth}

     Clam AntiVirus is free software; you can redistribute it and/or modify

     it under the terms of the GNU General Public License as published by

     the Free Software Foundation; either version 2 of the License, or

-    (at your option) any later version.

+    (at your option) any later version.\\

     This program is distributed in the hope that it will be useful,

     but WITHOUT ANY WARRANTY; without even the implied warranty of

     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

-    GNU General Public License for more details.

+    GNU General Public License for more details.\\

     You should have received a copy of the GNU General Public License

     along with this program; if not, write to the Free Software

@@ -106,15 +101,20 @@

     MA 02110-1301, USA.

     \end{boxedminipage}

+    \vspace{0.5cm}

+    \noindent

+    \begin{boxedminipage}[b]{\textwidth}

+    ClamAV and Clam AntiVirus are trademarks of Tomasz Kojm.

+    \end{boxedminipage}

+

     \newpage

     \section{Introduction}

-

-    Clam AntiVirus is an anti-virus toolkit for UNIX, designed for e-mail

-    scanning on mail gateways. It provides a flexible and scalable

-    multi-threaded daemon, a command line scanner, and an advanced tool for

-    automatic database updating via Internet. The package also includes

-    a virus scanner shared library.

+    Clam AntiVirus is an anti-virus toolkit for UNIX, designed especially

+    for e-mail scanning on mail gateways. It provides a number of utilities

+    including a flexible and scalable multi-threaded daemon, a command line

+    scanner and advanced tool for automatic database updates. The core of the

+    package is an anti-virus engine available in a form of shared library.

     \subsection{Features}

@@ -123,34 +123,51 @@

 	\item{POSIX compliant, portable}

 	\item{Fast scanning}

 	\item{Supports on-access scanning (Linux and FreeBSD only)}

-	\item{Detects over 35000 viruses, worms, and trojans, including

-	      Microsoft Office and MacOffice macro viruses}

+	\item{Detects over 90.000 viruses, worms and trojans, including

+	      Microsoft Office macro viruses, mobile malware, and other threats}

 	\item{Scans within archives and compressed files (also protects

 	      against archive bombs), built-in support includes:

-	      \begin{itemize}

-		\item Zip

-		\item RAR (2.0)

+	    \begin{itemize}

+		\item Zip (including SFX)

+		\item RAR (including SFX)

 		\item Tar

 		\item Gzip

 		\item Bzip2

 		\item MS OLE2

-		\item MS Cabinet Files

+		\item MS Cabinet Files (including SFX)

 		\item MS CHM (Compiled HTML)

 		\item MS SZDD compression format

-	      \end{itemize}}

-	\item{Supports Portable Executable files compressed with:}

-	      \begin{itemize}

+		\item BinHex

+		\item SIS (SymbianOS packages)

+	    \end{itemize}}

+	\item{Supports Portable Executable (32/64-bit) files compressed or obfuscated with:}

+	    \begin{itemize}

 		\item UPX

 		\item FSG

 		\item Petite

-	      \end{itemize}

-	\item{Powerful mail scanner}

-	\item{Advanced database updater with support for digital signatures

-	      and DNS based database version queries}

+		\item NsPack

+		\item wwpack32

+		\item MEW

+		\item Upack

+		\item SUE

+		\item Y0da Cryptor

+	    \end{itemize}

+	\item{Supports almost all mail file formats}

+	\item{Support for other special files/formats includes:}

+	    \begin{itemize}

+		\item HTML

+		\item RTF

+		\item PDF

+		\item Files encrypted with CryptFF and ScrEnc

+		\item uuencode

+		\item TNEF (winmail.dat)

+	    \end{itemize}

+	\item{Advanced database updater with support for scripted updates,

+	      digital signatures and DNS based database version queries}

     \end{itemize}

-    \subsection{Mailing lists}

-    If you have a trouble installing or using ClamAV try to ask on our mailing

+    \subsection{Mailing lists and IRC channel}

+    If you have a trouble installing or using ClamAV try asking on our mailing

     lists. There are four lists available:

     \begin{itemize}

     \item \textbf{clamav-announce*lists.clamav.net} - info about new versions,

@@ -161,15 +178,17 @@

     \item \textbf{clamav-virusdb*lists.clamav.net} - database update announcements, moderated

     \end{itemize}

     \noindent You can subscribe and search the mailing list archives at: 

-    \url{http://www.clamav.net/ml.html}\\

+    \url{http://www.clamav.net/support/ml/}\\

+    Alternatively you can try asking on the \verb+#clamav+ IRC channel - launch

+    your favourite irc client and type:

+    \begin{verbatim}

+	/server irc.freenode.net

+	/join #clamav

+    \end{verbatim}

     \subsection{Virus submitting}

     If you have got a virus which is not detected by your ClamAV with the latest

-    databases, please check it with the \emph{ClamAV Online Specimen Scanner}:

-    \begin{center}

-	\url{http://test-clamav.power-netz.de/}

-    \end{center}

-    and then submit it on our website:

+    databases, please submit the sample at our website:

     \begin{center}

 	\url{http://www.clamav.net/sendvirus.html}

     \end{center}

@@ -177,146 +196,22 @@

     \section{Base package}

     \subsection{Supported platforms}

-    All popular operating systems are supported. Clam AntiVirus was tested

-    on:

+    Most popular UNIX operating systems are supported. Clam AntiVirus 0.90 was

+    tested on:

     \begin{itemize}

 	\item{GNU/Linux}

 	\item{Solaris}

 	\item{FreeBSD}

 	\item{OpenBSD} \footnote{Installation from a port is recommended.}

-	\item{AIX 4.1/4.2/4.3/5.1}

-	\item{HPUX 11.0}

-	\item{SCO UNIX}

-	\item{IRIX 6.5.20f}

 	\item{Mac OS X}

-	\item{BeOS}

-	\item{Cobalt MIPS boxes}

-	\item{Cygwin}

-	\item{Windows Services for Unix 3.5 (Interix)}

     \end{itemize}

     Some features may not be available on your operating system. If you

     are successfully running Clam AntiVirus on a system not listed above

     please let us know.

     \subsection{Binary packages}

-    \begin{itemize}

-	\item \textbf{Debian}\\

-	The package is maintained by Stephen Gran and Thomas Lamy.

-	ClamAV has been officially included in the Debian distribution

-	starting from the Sarge release. Run \verb+apt-cache search clamav+ to

-	find the names of the packages available for installation. Unofficial

-	packages for Woody and Sarge are available and they are usually more

-	recent than official ones. Add the following lines to your

-	/etc/apt/sources.list:

-	\begin{verbatim}

-	for stable/woody (i386):

-	deb http://people.debian.org/~sgran/debian woody main

-	deb-src http://people.debian.org/~sgran/debian woody main

-	for testing/sarge (i386):

-	deb http://people.debian.org/~sgran/debian sarge main

-	deb-src http://people.debian.org/~sgran/debian sarge main

-	\end{verbatim}

-	Feel free to search for clamav on \url{http://www.apt-get.org/} too. 

-

-	\item \textbf{RedHat - Fedora}\\

-	The packages are maintained by Petr Kristof.\\

-	Fedora1: \url{http://crash.fce.vutbr.cz/crash-hat/1/clamav/}\\

-	Fedora2: \url{http://crash.fce.vutbr.cz/crash-hat/2/clamav/}\\

-	Devel snapshots: \url{http://crash.fce.vutbr.cz/crash-hat/testing/2/}\\

-	Please follow the instructions at

-	\url{http://crash.fce.vutbr.cz/yum-repository.html} and then run:

-	\begin{verbatim}

-	yum update clamav

-	or

-	up2date -u clamav

-	\end{verbatim}

-	Another very good repository is maintained by Dag Wieers:

-	\url{http://dag.wieers.com/packages/clamav/}

-

-	\item \textbf{PLD Linux Distribution}\\

-	The RPM packages for the Polish(ed) Linux Distribution are maintained

-	by Arkadiusz Miskiewicz (visit \url{http://www.pld-linux.org/}). 

-

-	\item \textbf{Mandrake}\\

-	A RPM package for Mandrake is available on Mandrake's mirrors and is

-	maintained by Oden Eriksson. Another set of RPM packages (maintained

-	by Bill Randle) is available at \url{ftp://ftp.neocat.org/pub/}.

-

-	\item \textbf{Slackware}\\

-	Slackware packages without milter support are maintained by Jay Scott

-	Raymond. You can find them at

-	\url{http://webpages.charter.net/jay_scott_raymond/linux/slackages/}

-	If you need milter enabled ClamAV, try Peter Kaagman's packages

-	available at \url{http://bilbos-stekkie.com/clamav/}\\ Both of them are

-	also available at \url{http://www.linuxpackages.net/}

-

-	\item \textbf{SuSE}

-	SuSE 8.2 and 9.1 RPMs are maintained by Joe Benden. You can download

-	them at \url{http://www.ispservices.com/clamav.html}. Official ClamAV

-	packages for SuSE are maintained by Reinhard Max.

-

-	\item \textbf{FreeBSD}\\

-	The official FreeBSD port is maintained by Masahiro Teramoto. There

-	are two version available: clamav and clamav-devel. You can find both

-	of them under /usr/ports/security/

-

-	\item \textbf{OpenBSD}\\

-	ClamAV will become part of the official ports tree in the upcoming

-	3.7 release of OpenBSD. The new port is maintained by Marc Balmer. The

-	old unofficial port for OpenBSD (maintained by Jerome Loyet) is

-	available at: \url{http://www.fatbsd.com/openbsd/clamav/}

-

-	\item \textbf{NetBSD}\\

-	The official port is available.

-

-	\item \textbf{Solaris}\\

-	Stable packages and daily snapshots for Solaris 8 SPARC are available

-	at \url{http://clamav.or.id/snapshot/}. Latest stable packages for

-	Solaris 9 SPARC 64bit are available at \url{http://clamav.citrus-it.net}

-

-	\item \textbf{AIX}\\

-	The binary packages for AIX are available in AIX PDSLIB, UCLA\\

-	\url{http://aixpdslib.seas.ucla.edu/packages/clamav.html}

-

-	\item \textbf{Mac OS X}\\

-	There's a binary package available at

-	\url{http://clamav.darwinports.com/}\\

-	clamXav (see \ref{clamxav}), a GUI for ClamAV running on MacOS X, is

-	available at \url{http://www.markallan.co.uk/clamXav}

-

-	\item \textbf{BeOS}\\

-	BeClam is a port of ClamAV for the BeOS operating system. It includes

-	a very simple GUI. Get it at \url{http://www.bebits.com/app/3930/}

-

-	\item \textbf{MS Windows - Cygwin}\\

-	ClamAV is a part of the official Cygwin port repository.

-

-	\item \textbf{MS Windows - cygwin.dll based}\\

-	All major features of ClamAV are implemented under Win32 using the

-	Cygwin compatibility layer. You can download a self-installing

-	package at\\ \url{http://www.sosdg.org/clamav-win32/index.php}

-

-	\item \textbf{MS Windows - Interix}\\

-	A binary package of ClamAV for Interix is maintained at\\

-	\url{http://www.interopsystems.com/tools/warehouse.htm}

-

-	\item \textbf{MS Windows - graphical version}\\

-	A standalone GUI version is also available. See ClamWin

-	in the \emph{Third Party Software} section (\ref{clamwin}).

-    \end{itemize}

-

-    \subsection{Daily built snapshots}

-    Thanks to Fajar A. Nugraha you can download daily builds (from daily

-    snapshots) for the following operating systems:

-    \begin{itemize}

-	\item SPARC Solaris 8/9

-	\item DEC OSF (built on Tru64 UNIX V5.0A)

-	\item AIX (built on AIX Version 5.1)

-	\item Linux i386 with glibc 2.3 (compiled on Fedora Core 1,

-	      works on RH $\ge$ 8)

-	\item Win32/Cygwin (compiled on XP)

-    \end{itemize}

-    They're available at \url{http://clamav.or.id/}

+    You can find the up-to-date list of binary packages at our website:

+    \url{http://www.clamav.net/download/packages/}

     \section{Installation}

@@ -324,7 +219,7 @@

     The following elements are required to compile ClamAV:

     \begin{itemize}

 	\item zlib and zlib-devel packages

-	\item gcc compiler suite (both 2.9x and 3.x are supported)

+	\item gcc compiler suite (tested with 2.9x, 3.x and 4.x series)

     \end{itemize}

     The following packages are optional but \textbf{highly recommended}:

     \begin{itemize}

@@ -332,18 +227,19 @@

 	\item GNU MP 3\\

 	It's very important to install the GMP package because it allows

 	\verb+freshclam+ to verify the digital signatures of the virus

-	databases. If freshclam was compiled without GMP support it will

-	display "SECURITY WARNING: NO SUPPORT FOR DIGITAL SIGNATURES" on every

-	update. You can download GNU MP at \url{http://www.swox.com/gmp/}\\

+	databases and scripted updates. If freshclam was compiled without GMP

+	support it will display "SECURITY WARNING: NO SUPPORT FOR DIGITAL

+	SIGNATURES" on every update. You can download GNU MP at

+	\url{http://www.swox.com/gmp/}\\

 	A note for Solaris/SPARC users: you must set the \emph{ABI} system

 	variable to 32 (e.g. \verb+setenv ABI 32+) before running the

 	configuration script of GMP.

     \end{itemize}

-    \subsection{Installing on a shell account}

-    To install ClamAV on a shell account (e.g. on some shared host) you

-    need not create any additional users or groups. Assuming your

-    home directory is \verb+/home/gary+ you should build it as follows:

+    \subsection{Installing on shell account}

+    To install ClamAV locally on an unprivileged shell account you need not

+    create any additional users or groups. Assuming your home directory is

+    \verb+/home/gary+ you should build it as follows:

     \begin{verbatim}

 	$ ./configure --prefix=/home/gary/clamav --disable-clamav

 	$ make; make install

@@ -353,21 +249,21 @@

 	$ ~/clamav/bin/freshclam

 	$ ~/clamav/bin/clamscan ~

     \end{verbatim}

-    The \verb+--disable-clamav+ switch disables testing for the existence of

+    The \verb+--disable-clamav+ switch disables the check for existence of

     the \emph{clamav} user and group but \verb+clamscan+ would still require an

     unprivileged account to work in a superuser mode.

     \subsection{Adding new system user and group}

     If you are installing ClamAV for the first time, you have to add a new

     user and group to your system: \footnote{Cygwin note: If you have not

-    /etc/passwd you can skip this procedure}

+    /etc/passwd you can skip this point}

     \begin{verbatim}

 	# groupadd clamav

 	# useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav

     \end{verbatim}

     Consult a system manual if your OS has not \emph{groupadd} and

-    \emph{useradd} utilities. The account should be locked in

-    \emph{/etc/passwd} or \emph{/etc/shadow}.

+    \emph{useradd} utilities. \textbf{Don't forget to lock access to the

+    account!}

     \subsection{Compilation of base package}

     Once you have created the clamav user and group, please extract the archive:

@@ -376,18 +272,15 @@

 	$ cd clamav-x.yz

     \end{verbatim}

     Assuming you want to install the configuration files in /etc, configure

-    the package as follows:

+    and build the software as follows:

     \begin{verbatim}

 	$ ./configure --sysconfdir=/etc

-    \end{verbatim}

-    Currently \emph{gcc} is required to compile ClamAV.

-    \begin{verbatim}

 	$ make

 	$ su -c "make install"

     \end{verbatim}

-    In the last step the software is installed in the /usr/local directory

-    and the config file goes to /etc. \textbf{WARNING: Never enable the SUID

-    or SGID bits in Clam AntiVirus binaries.}

+    In the last step the software is installed into the /usr/local directory

+    and the config files into /etc. \textbf{WARNING: Never enable the SUID

+    or SGID bits for Clam AntiVirus binaries.}

     \subsection{Compilation with clamav-milter enabled}

     libmilter and its development files are required. To enable clamav-milter,

@@ -399,7 +292,7 @@

     \section{Configuration}

     \subsection{clamd}

-    If you are going to use the daemon, you have to edit the configuration file

+    Before you start using the daemon you have to edit the configuration file

     (in other case \verb+clamd+ won't run):

     \begin{verbatim}

 	$ clamd

@@ -411,13 +304,12 @@

     straightforward.

     \subsubsection{On-access scanning}

-    An interesting feature of \verb+clamd+ is on-access scanning based on the

-    Dazuko module, available from \url{http://dazuko.org/}. \textbf{It is not

-    required to run clamd - furthermore, you shouldn't run Dazuko on production

-    systems}. The special thread in \verb+clamd+ responsible for the

-    communication with Dazuko is called "Clamuko" (due to the funny name of

-    Dazuko) and it's only supported on Linux and FreeBSD. To compile dazuko

-    execute:

+    One of the interesting features of \verb+clamd+ is on-access scanning

+    based on the Dazuko module, available from \url{http://dazuko.org/}.

+    \textbf{This module is not required to run clamd - furthermore, you

+    shouldn't run Dazuko on production systems}. At the moment Dazuko is

+    avaliable for Linux and FreeBSD, but the following information only covers

+    Linux.

     \begin{verbatim}

 	$ tar zxpvf dazuko-a.b.c.tar.gz

 	$ cd dazuko-a.b.c

@@ -429,10 +321,10 @@

 	# cp dazuko.o /lib/modules/`uname -r`/misc

 	# depmod -a

     \end{verbatim}

-    Depending on your Linux distribution you have to add a "dazuko" entry to

+    Depending on your Linux distribution you may need to add a "dazuko" entry to

     \emph{/etc/modules} or run the module during system's startup by adding

     \begin{verbatim}

-	modprobe dazuko

+	/sbin/modprobe dazuko

     \end{verbatim}

     to some startup file. You must also create a new device:

     \begin{verbatim}

@@ -444,11 +336,11 @@

     section.

     \subsection{clamav-milter}

-    Nigel Horne's \verb+clamav-milter+ is a very fast email scanner designed for

-    Sendmail. It's written entirely in C and only depends on \verb+libclamav+

-    or \verb+clamd+. You can find detailed installation instructions in the

-    \verb+INSTALL+ file that comes with the clamav-milter sources. Basically,

-    to connect it with Sendmail add the following lines to

+    Nigel Horne's \verb+clamav-milter+ is a very efficient email scanner

+    designed for Sendmail. It's written entirely in C and only depends on

+    \verb+libclamav+ or \verb+clamd+. You can find detailed installation

+    instructions in the \verb+INSTALL+ file that comes with the clamav-milter

+    sources. Basically, to connect it with Sendmail add the following lines to

     \verb+/etc/mail/sendmail.mc+:

     \begin{verbatim}

 INPUT_MAIL_FILTER(`clmilter',`S=local:/var/run/clamav/clmilter.sock,

@@ -473,46 +365,44 @@ define(`confINPUT_MAIL_FILTERS', `clmilter')

     \end{verbatim}

     It should find some test files in the clamav-x.yz/test directory.

     The scan result will be saved in the \verb+scan.txt+ log file

-    \footnote{To get more info on clamscan options execute 'man clamscan'}.

-    To test \verb+clamd+, start it and use \verb+clamdscan+ (or connect directly

-    to its socket and run the SCAN command instead):

+    \footnote{To get more info on clamscan options run 'man clamscan'}.

+    To test \verb+clamd+, start it and use \verb+clamdscan+ (or instead connect

+    directly to its socket and run the SCAN command):

     \begin{verbatim}

 	$ clamdscan -l scan.txt clamav-x.yz

     \end{verbatim}

     Please note that the scanned files must be accessible by the user running

-    \verb+clamd+ or you get an error.

+    \verb+clamd+ or you will get an error.

     \subsection{Setting up auto-updating}

-    \verb+freshclam+ is the default database updater for Clam AntiVirus.

+    \verb+freshclam+ is the automatic database update tool for Clam AntiVirus.

     It can work in two modes:

     \begin{itemize}

-	\item interactive - from command line, verbosely

-	\item daemon - alone, silently

+	\item interactive - on demand from command line

+	\item daemon - silently in the background

     \end{itemize}

-    When started by a superuser it drops privileges and switches

-    to the \emph{clamav} user. \verb+freshclam+ uses the

-    \url{database.clamav.net} round-robin DNS which automatically selects

-    a database mirror\ref{mirrors}. \verb+freshclam+ is an advanced tool:

-    it supports database version verification through DNS, proxy servers (with

+    \verb+freshclam+ is advanced tool: it supports scripted updates (instead

+    of transferring the whole CVD file at each update it only transfers the

+    differences between the latest and the current database via a special

+    script), database version checks through DNS, proxy servers (with

     authentication), digital signatures and various error scenarios.

     \textbf{Quick test: run freshclam (as superuser) with no parameters

     and check the output.} If everything is OK you may create the log file in

     /var/log (owned by \emph{clamav} or another user \verb+freshclam+ will be

-    running as (\verb+--user+):

+    running as):

     \begin{verbatim}

 	# touch /var/log/freshclam.log

 	# chmod 600 /var/log/freshclam.log

 	# chown clamav /var/log/freshclam.log

     \end{verbatim}

-    Now you \emph{should} edit the configuration file (\verb+freshclam.conf+ or

-    \verb+clamd.conf+ if they're merged) and configure the

-    \emph{UpdateLogFile} directive to point to the created log file.

-    Finally, to run \verb+freshclam+ in the daemon mode, execute:

+    Now you \emph{should} edit the configuration file \verb+freshclam.conf+

+    and point the \emph{UpdateLogFile} directive to the log file. Finally, to

+    run \verb+freshclam+ in the daemon mode, execute:

     \begin{verbatim}

 	# freshclam -d

     \end{verbatim}

-    The other method is to use the \emph{cron} daemon. You have to add the

-    following line to the crontab of the \textbf{root} or \textbf{clamav} users:

+    The other way is to use the \emph{cron} daemon. You have to add the

+    following line to the crontab of \textbf{root} or \textbf{clamav} user:

     {\small

     \begin{verbatim}

 N * * * *	/usr/local/bin/freshclam --quiet

@@ -521,8 +411,8 @@ N * * * *	/usr/local/bin/freshclam --quiet

     number between 3 and 57 of your choice. Please don't choose any multiple

     of 10, because there are already too many clients using those time slots.}

     Proxy settings are only configurable via the configuration file and

-    \verb+freshclam+ will require strict permissions on the config file when

-    \verb+HTTPProxyPassword+ is enabled.

+    \verb+freshclam+ will require strict permission settings for the config

+    file when \verb+HTTPProxyPassword+ is turned on.

     \begin{verbatim}

 	HTTPProxyServer myproxyserver.com

 	HTTPProxyPort 1234

@@ -530,7 +420,7 @@ N * * * *	/usr/local/bin/freshclam --quiet

 	HTTPProxyPassword mypass

     \end{verbatim}

-    \subsection{Closest mirrors}

+    \subsubsection{Closest mirrors}

     The \verb+DatabaseMirror+ directive in the config file specifies the

     database server \verb+freshclam+ will attempt (up to \verb+MaxAttempts+

     times) to download the database from. The default database mirror

@@ -538,13 +428,13 @@ N * * * *	/usr/local/bin/freshclam --quiet

     In order to download the database from the closest mirror you should  

     configure \verb+freshclam+ to use \url{db.xx.clamav.net} where xx

     represents your country code. For example, if your server is in "Ascension

-    Island" you should add the following lines to \verb+freshclam.conf+:

+    Island" you should have the following lines included in \verb+freshclam.conf+:

     \begin{verbatim}

 	DNSDatabaseInfo current.cvd.clamav.net

 	DatabaseMirror db.ac.clamav.net

 	DatabaseMirror database.clamav.net

     \end{verbatim}

-    The second entry acts as a fallback in case a connection to the first

+    The second entry acts as a fallback in case the connection to the first

     mirror fails for some reason. The full list of two-letters country codes

     is available at \url{http://www.iana.org/cctld/cctld-whois.htm}

@@ -552,8 +442,7 @@ N * * * *	/usr/local/bin/freshclam --quiet

     \subsection{Clam daemon}\label{clamd}

     \verb+clamd+ is a multi-threaded daemon that uses \emph{libclamav}

-    to scan files against viruses. It may work in one of the two network modes,

-    listening on a:

+    to scan files for viruses. It may work in one or both modes listening on:

     \begin{itemize}

 	\item Unix (local) socket

 	\item TCP socket

@@ -562,40 +451,43 @@ N * * * *	/usr/local/bin/freshclam --quiet

     \footnote{man 5 clamd.conf}. \verb+clamd+ recognizes the following commands:

     \begin{itemize}

 	\item \textbf{PING}\\

-	    Check daemon state (should reply with "PONG").

+	    Check the daemon's state (should reply with "PONG").

 	\item \textbf{VERSION}\\

 	    Print program and database versions.

 	\item \textbf{RELOAD}\\

-	    Reload databases.

+	    Reload the databases.

 	\item \textbf{SHUTDOWN}\\

 	    Perform a clean exit.

-	\item \textbf{SCAN file/directory}

+	\item \textbf{SCAN file/directory}\\

 	    Scan file or directory (recursively) with archive support

 	    enabled (a full path is required).

-	\item \textbf{RAWSCAN file/directory}

-	    Scan file or directory (recursively) with archive support

-	    disabled (a full path is required).

-	\item \textbf{CONTSCAN file/directory}

+	\item \textbf{RAWSCAN file/directory}\\

+	    Scan file or directory (recursively) with archive and special file

+	    support disabled (a full path is required).

+	\item \textbf{CONTSCAN file/directory}\\

 	    Scan file or directory (recursively) with archive support

-	    enabled and do not stop scanning if virus is found.

-	\item \textbf{STREAM}

+	    enabled and don't stop the scanning when a virus is found.

+	\item \textbf{MULTISCAN file/directory}\\

+	    Scan file in a standard way or scan directory (recursively) using

+	    multiple threads (to make the scanning faster on SMP machines).

+	\item \textbf{STREAM}\\

 	    Scan stream: \verb+clamd+ will return a new port number you should

 	    connect to and send data to scan.

-	\item \textbf{SESSION, END}

+	\item \textbf{SESSION, END}\\

 	    Start/end a \verb+clamd+ session - you can do multiple commands

 	    per TCP session (WARNING: due to the \verb+clamd+ implementation the

 	    \textbf{RELOAD} command will break the session).

     \end{itemize}

-    and reacts to the special signals:

+    and reacts on the special signals:

     \begin{itemize}

 	\item \textbf{SIGTERM} - perform a clean exit

-	\item \textbf{SIGHUP} - reopen a log file

+	\item \textbf{SIGHUP} - reopen the log file

 	\item \textbf{SIGUSR2} - reload the database

     \end{itemize}

     \subsection{Clam\textbf{d}scan}

     \verb+clamdscan+ is a simple \verb+clamd+ client. In many cases you can

-    use it as a \verb+clamscan+ replacement but you must remember that:

+    use it as a \verb+clamscan+ replacement however you must remember that:

     \begin{itemize}

 	\item it only depends on \verb+clamd+

 	\item although it accepts the same command line options as

@@ -612,15 +504,15 @@ N * * * *	/usr/local/bin/freshclam --quiet

     using it:}

     \begin{itemize}

 	\item Always stop the daemon cleanly - using the SHUTDOWN command or

-	      the\\ SIGTERM signal. In other case you can lose an access

+	      the\\ SIGTERM signal. In other case you can lose access

 	      to protected files until the system is restarted.

-	\item Never protect a directory your mail-scanner software

+	\item Never protect the directory your mail-scanner software

 	      uses for attachment unpacking. Access to all infected

-	      files will be automatically blocked and the scanner (even

-	      \verb+clamd+) won't be able to detect any virus. In the result

-	      \textbf{all infected mails will be delivered.}

+	      files will be automatically blocked and the scanner (including

+	      \verb+clamd+!) will not be able to detect any viruses. In the

+	      result \textbf{all infected mails may be delivered.}

     \end{itemize}

-    For example, to protect a whole system add the following lines to

+    For example, to protect the whole system add the following lines to

     \verb+clamd.conf+:

     \begin{verbatim}

 	ClamukoScanOnAccess

@@ -628,17 +520,18 @@ N * * * *	/usr/local/bin/freshclam --quiet

 	ClamukoExcludePath /proc

 	ClamukoExcludePath /temporary/dir/of/your/mail/scanning/software

     \end{verbatim}

-    You can also use clamuko to protect files on Samba/Netatalk but far

-    more better and safe idea is to use the \textbf{samba-vscan} module

-    \ref{samba-vscan}. NFS is not supported because Dazuko doesn't intercept

-    NFS access calls.

+    You can also use clamuko to protect files on Samba/Netatalk but a far

+    more better and safe idea is to use the \textbf{samba-vscan} module.

+    NFS is not supported because Dazuko doesn't intercept NFS access calls.

     \subsection{Output format}

     \subsubsection{clamscan}

-    \verb+clamscan+ by default writes all messages to \textbf{stderr}.

-    Run it with \verb+--stdout+ enabled to redirect them to the standard

-    output. An example of the \verb+clamscan+ output is:

+    \verb+clamscan+ writes all regular program messages to \textbf{stdout} and

+    errors/warnings to \textbf{stderr}. You can use the option \verb+--stdout+

+    to redirect all program messages to \textbf{stdout}. Warnings and error

+    messages from \verb+libclamav+ are always printed to \textbf{stderr}.

+    A typical output from \verb+clamscan+ looks like this:

     \begin{verbatim}

 	/tmp/test/removal-tool.exe: Worm.Sober FOUND

 	/tmp/test/md5.o: OK

@@ -654,9 +547,9 @@ N * * * *	/usr/local/bin/freshclam --quiet

 	malware.zip: Worm.Mydoom.U FOUND

     \end{verbatim}

     \emph{\textbf{TIP:} You can force clamscan to list all infected

-    files in an archive using --no-archive (that disables transparent

-    decompressors built into libclamav) and external decompressors: --unzip

-    --unrar...}.\\[4pt]

+    files in an archive using --no-archive (this option disables

+    transparent decompressors built into libclamav) and enabling external

+    decompressors: --unzip --unrar...}.\\[4pt]

     \begin{verbatim}

 	zolw@localhost:/tmp$ clamscan --no-archive --unzip malware.zip

 	Archive:  /tmp/malware.zip

@@ -670,7 +563,7 @@ N * * * *	/usr/local/bin/freshclam --quiet

     \end{verbatim}

     \subsubsection{clamd}

-    \verb+clamd+ uses a \verb+clamscan+ compatible output format:

+    The output format of \verb+clamd+ is very similar to \verb+clamscan+.

     \begin{verbatim}

 	zolw@localhost:~$ telnet localhost 3310

 	Trying 127.0.0.1...

@@ -686,7 +579,8 @@ N * * * *	/usr/local/bin/freshclam --quiet

 	SCAN /home/zolw/test/clam.zip

 	/home/zolw/test/clam.zip: ClamAV-Test-File FOUND

     \end{verbatim}

-    \textbf{CONTSCAN} continues scanning even if virus was already found.\\

+    \textbf{CONTSCAN} and \textbf{MULTISCAN} don't stop scanning in case

+    a virus is found.\\

     Error messages are printed in the following format:

     \begin{verbatim}

 	SCAN /no/such/file

@@ -694,96 +588,133 @@ N * * * *	/usr/local/bin/freshclam --quiet

     \end{verbatim}

     \section{LibClamAV}

-    libclamav is a simple and easy way to add a virus protection to your

-    software. The library is thread-safe and transparently recognizes and

+    Libclamav provides an easy and effective way to add a virus protection into

+    your software. The library is thread-safe and transparently recognizes and

     scans within archives, mail files, MS Office document files, executables

-    and other file formats.

+    and other special formats.

     \subsection{Licence}

-    libclamav is licensed under the GNU GPL licence. That means you are

+    Libclamav is licensed under the GNU GPL v2 licence. This means you are

     \textbf{not allowed} to link commercial, close-source applications

     against it\footnote{You can still use clamd or clamscan instead}.

     All software using libclamav must be GPL compliant.

-    \subsection{Features}

+    \subsection{Supported formats}

+

+    \subsubsection{Executables}

+    The library has a built-in support for 32/64-bit Portable Executable files

+    and 32-bit ELF files. Additionally, it can handle PE files compressed or

+    obfuscated with the following tools:

+    \begin{itemize}

+	\item UPX (all versions)

+	\item FSG (1.3, 1.31, 1.33, 2.0)

+	\item Petite (2.x)

+	\item NsPack

+	\item wwpack32 (1.20)

+	\item MEW

+	\item Upack

+	\item SUE

+	\item Y0da Cryptor (1.3)

+    \end{itemize}

+

+    \subsubsection{Mail files}

+    Libclamav can handle almost every mail file format including TNEF

+    (winmail.dat) attachments.

     \subsubsection{Archives and compressed files}

-    The library has a built-in support for the following formats:

+    The following archive and compression formats are supported by internal

+    handlers:

     \begin{itemize}

-	\item Zip

-	\item RAR (2.0)

+	\item Zip (+ SFX)

+	\item RAR (+ SFX)

 	\item Tar

 	\item Gzip

 	\item Bzip2

 	\item MS OLE2

-	\item MS Cabinet Files

+	\item MS Cabinet Files (+ SFX)

 	\item MS CHM (Compiled HTML)

 	\item MS SZDD compression format

-	\item UPX (all versions)

-	\item FSG (1.3, 1.31, 1.33, 2.0)

-	\item Petite (2.x)

+	\item BinHex

+	\item SIS (SymbianOS packages)

     \end{itemize}

-    Due to license issues, support for RAR 3.0 archives is currently not

-    available in libclamav (such archives will trigger the

-    \verb+RAR module failure.+ error message). You can scan them with the help

-    of external unpackers in \verb+clamscan+, though.

-    \begin{verbatim}

-	$ clamscan --unrar clam-error.rar

-	/home/zolw/test/clam-error.rar: RAR module failure.

-

-	UNRAR 3.00 freeware      Copyright (c) 1993-2002 Eugene Roshal

+    \subsubsection{Documents}

+    The most popular file formats are supported:

+    \begin{itemize}

+	\item MS Office and MacOffice files

+	\item RTF

+	\item PDF

+	\item HTML

+    \end{itemize}

-	Extracting from /home/zolw/test/clam-error.rar

-

-	Extracting  clam.exe                                        OK 

-	All OK

-	/tmp/44694f5b2665d2f4/clam.exe: ClamAV-Test-File FOUND

-	/home/zolw/test/clam-error.rar: Infected.Archive FOUND

-    \end{verbatim}

+    \subsubsection{Others}

+    Libclamav can handle various obfuscators, encoders, files vulnerable to

+    security risks such as:

+    \begin{itemize}

+	\item JPEG (exploit detection)

+	\item RIFF (exploit detection)

+	\item uuencode

+	\item ScrEnc obfuscation

+	\item CryptFF

+    \end{itemize}

-    \subsubsection{Mail files}

-    Advanced mail scanner built into libclamav transparently scans e-mails

-    for infected attachments. All popular UNIX mail formats are supported.

-    TNEF attachments are supported as well.

+    \subsection{Hardware acceleration}

+    ClamAV 0.90 comes with support for Sensory Networks' NodalCore

+    acceleration technology. Thanks to specialized Security Processing Unit

+    built into NodalCore C-Series accelerators it is possible to achieve more

+    performance than is possible by just adding general purpose CPUs.

+    Additionally, Sensory Networks' CorePAKT technology ensures that compiled

+    signature databases occupy a memory footprint smaller than any other

+    competing technology on the market - in many cases by up to 90\%. The

+    ability to store multiple databases in compressed format whilst still

+    achieving high throughputs makes NodalCore ideal for applications

+    demanding high performance on large signature databases such as ClamAV.\\

+    For more information please visit \url{http://www.clamav.net/nodalcore/}

     \subsection{API}

     \subsubsection{Header file}

-    Every program using libclamav must include the \verb+clamav.h+ header

-    file:

+    Every program using libclamav must include the header file \verb+clamav.h+:

     \begin{verbatim}

 	#include <clamav.h>

     \end{verbatim}

     \subsubsection{Database loading}

-    The following set of functions provides an interface to database

-    initialisation mechanisms:

+    The following set of functions provides an interface for loading

+    the virus database:

     \begin{verbatim}

-	int cl_loaddb(const char *filename, struct cl_node **root,

-	unsigned int *signo);

-

-	int cl_loaddbdir(const char *dirname, struct cl_node **root,

-	unsigned int *signo);

-