@@ -1,3 +1,7 @@

+Tue Aug  2 17:03:33 CEST 2011 (tk)

+----------------------------------

+ * docs: clarify behavior of --scan-*/Scan* options (bb#3134)

+

 Mon Jul 25 16:09:19 EEST 2011 (edwin)

 -------------------------------------

  * libclamav/bytecode_vm.c: fix opcode 20 error (bb #3100)

@@ -115,7 +115,7 @@ This option sets the lowest number of Social Security Numbers found in a file to

 This option sets the lowest number of Credit Card numbers found in a file to generate a detect (default: 3).

 .TP 

 \fB\-\-scan\-mail[=yes(*)/no]\fR

-Scan mail files.

+Scan mail files. If you turn off this option, the original files will still be scanned, but without parsing individual messages/attachments.

 .TP 

 \fB\-\-phishing\-sigs[=yes(*)/no]\fR

 Use the signature-based phishing detection.

@@ -136,22 +136,22 @@ Block cloaked URLs (might lead to some false positives).

 In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option can be used to control the algorithmic detection.

 .TP 

 \fB\-\-scan\-pe[=yes(*)/no]\fR

-PE stands for Portable Executable \- it's an executable file format used in all 32\-bit versions of Windows operating systems. By default ClamAV performs deeper analysis of executable files and attempts to decompress popular executable packers such as UPX, Petite, and FSG.

+PE stands for Portable Executable \- it's an executable file format used in all 32\-bit versions of Windows operating systems. By default ClamAV performs deeper analysis of executable files and attempts to decompress popular executable packers such as UPX, Petite, and FSG. If you turn off this option, the original files will still be scanned but without additional processing.

 .TP 

 \fB\-\-scan\-elf[=yes(*)/no]\fR

-Executable and Linking Format is a standard format for UN*X executables. This option controls the ELF support.

+Executable and Linking Format is a standard format for UN*X executables. This option controls the ELF support. If you turn it off, the original files will still be scanned but without additional processing.

 .TP 

 \fB\-\-scan\-ole2[=yes(*)/no]\fR

-Scan Microsoft Office documents and .msi files.

+Scan Microsoft Office documents and .msi files. If you turn off this option, the original files will still be scanned but without additional processing.

 .TP 

 \fB\-\-scan\-pdf[=yes(*)/no]\fR

-Scan within PDF files.

+Scan within PDF files. If you turn off this option, the original files will still be scanned, but without decoding and additional processing.

 .TP 

 \fB\-\-scan\-html[=yes(*)/no]\fR

-Detect, normalize/decrypt and scan HTML files and embedded scripts.

+Detect, normalize/decrypt and scan HTML files and embedded scripts. If you turn off this option, the original files will still be scanned, but without additional processing.

 .TP 

 \fB\-\-scan\-archive[=yes(*)/no]\fR

-Scan archives supported by libclamav.

+Scan archives supported by libclamav. If you turn off this option, the original files will still be scanned, but without unpacking and additional processing.

 .TP 

 \fB\-\-detect\-broken[=yes/no(*)]\fR

 Mark broken executables as viruses (Broken.Executable).

@@ -240,12 +240,15 @@ Example

 # in all 32 and 64-bit versions of Windows operating systems. This option allows

 # ClamAV to perform a deeper analysis of executable files and it's also

 # required for decompression of popular executable packers such as UPX, FSG,

-# and Petite.

+# and Petite. If you turn off this option, the original files will still be

+# scanned, but without additional processing.

 # Default: yes

 #ScanPE yes

 # Executable and Linking Format is a standard format for UN*X executables.

 # This option allows you to control the scanning of ELF files.

+# If you turn off this option, the original files will still be scanned, but

+# without additional processing.

 # Default: yes

 #ScanELF yes

@@ -261,6 +264,8 @@ Example

 # This option enables scanning of OLE2 files, such as Microsoft Office

 # documents and .msi files.

+# If you turn off this option, the original files will still be scanned, but

+# without additional processing.

 # Default: yes

 #ScanOLE2 yes

@@ -271,6 +276,8 @@ Example

 #OLE2BlockMacros no

 # This option enables scanning within PDF files.

+# If you turn off this option, the original files will still be scanned, but

+# without decoding and additional processing.

 # Default: yes

 #ScanPDF yes

@@ -280,6 +287,8 @@ Example

 ##

 # Enable internal e-mail scanner.

+# If you turn off this option, the original files will still be scanned, but

+# without parsing individual messages/attachments.

 # Default: yes

 #ScanMail yes

@@ -363,6 +372,8 @@ Example

 # Perform HTML normalisation and decryption of MS Script Encoder code.

 # Default: yes

+# If you turn off this option, the original files will still be scanned, but

+# without additional processing.

 #ScanHTML yes

@@ -371,6 +382,8 @@ Example

 ##

 # ClamAV can scan within archives and compressed files.

+# If you turn off this option, the original files will still be scanned, but

+# without unpacking and additional processing.

 # Default: yes

 #ScanArchive yes

@@ -276,13 +276,13 @@ const struct clam_option __clam_options[] = {

     { "AlgorithmicDetection", "algorithmic-detection", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "In some cases (eg. complex malware, exploits in graphic files, and others),\nClamAV uses special algorithms to provide accurate detection. This option\ncontrols the algorithmic detection.", "yes" },

-    { "ScanPE", "scan-pe", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "PE stands for Portable Executable - it's an executable file format used\nin all 32- and 64-bit versions of Windows operating systems. This option\nallows ClamAV to perform a deeper analysis of executable files and it's also\nrequired for decompression of popular executable packers such as UPX or FSG.", "yes" },

+    { "ScanPE", "scan-pe", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "PE stands for Portable Executable - it's an executable file format used\nin all 32- and 64-bit versions of Windows operating systems. This option\nallows ClamAV to perform a deeper analysis of executable files and it's also\nrequired for decompression of popular executable packers such as UPX or FSG.\nIf you turn off this option, the original files will still be scanned, but\nwithout additional processing.", "yes" },

-    { "ScanELF", "scan-elf", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Executable and Linking Format is a standard format for UN*X executables.\nThis option allows you to control the scanning of ELF files.", "yes" },

+    { "ScanELF", "scan-elf", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Executable and Linking Format is a standard format for UN*X executables.\nThis option allows you to control the scanning of ELF files.\nIf you turn off this option, the original files will still be scanned, but\nwithout additional processing.", "yes" },

     { "DetectBrokenExecutables", "detect-broken", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "With this option enabled clamav will try to detect broken executables\n(both PE and ELF) and mark them as Broken.Executable.", "yes" },

-    { "ScanMail", "scan-mail", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Enable the built in email scanner.", "yes" },

+    { "ScanMail", "scan-mail", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Enable the built in email scanner.\nIf you turn off this option, the original files will still be scanned, but\nwithout parsing individual messages/attachments.", "yes" },

     { "ScanPartialMessages", NULL, 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD, "Scan RFC1341 messages split over many emails. You will need to\nperiodically clean up $TemporaryDirectory/clamav-partial directory.\nWARNING: This option may open your system to a DoS attack. Please don't use\nthis feature on highly loaded servers.", "no" },

@@ -306,15 +306,15 @@ const struct clam_option __clam_options[] = {

     { "StructuredSSNFormatStripped", NULL, 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD, "With this option enabled the DLP module will search for valid\nSSNs formatted as xxxyyzzzz", "no" },

-    { "ScanHTML", "scan-html", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Perform HTML/JavaScript/ScriptEncoder normalisation and decryption.", "yes" },

+    { "ScanHTML", "scan-html", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Perform HTML/JavaScript/ScriptEncoder normalisation and decryption.\nIf you turn off this option, the original files will still be scanned, but\nwithout additional processing.", "yes" },

-    { "ScanOLE2", "scan-ole2", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "This option enables scanning of OLE2 files, such as Microsoft Office\ndocuments and .msi files.", "yes" },

+    { "ScanOLE2", "scan-ole2", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "This option enables scanning of OLE2 files, such as Microsoft Office\ndocuments and .msi files.\nIf you turn off this option, the original files will still be scanned, but\nwithout additional processing.", "yes" },

     { "OLE2BlockMacros", NULL, 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD, "With this option enabled OLE2 files with VBA macros, which were not\ndetected by signatures will be marked as \"Heuristics.OLE2.ContainsMacros\".", "no" },

-    { "ScanPDF", "scan-pdf", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "This option enables scanning within PDF files.", "yes" },

+    { "ScanPDF", "scan-pdf", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "This option enables scanning within PDF files.\nIf you turn off this option, the original files will still be scanned, but\nwithout decoding and additional processing.", "yes" },

-    { "ScanArchive", "scan-archive", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Scan within archives and compressed files.", "yes" },

+    { "ScanArchive", "scan-archive", 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Scan within archives and compressed files.\nIf you turn off this option, the original files will still be scanned, but\nwithout unpacking and additional processing.", "yes" },

     { "ArchiveBlockEncrypted", "block-encrypted", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).", "no" },