CVD format

CVD (ClamAV Virus Database) is a digitally signed tarball file that contains one or more databases. You can find some useful information in the ASCII header of the file. It's a 512 bytes long string with the following colon separated fields:

ClamAV-VDB:build time:version:number of signatures:functionality
level required:MD5 checksum:digital signature:builder name

and can be easily parsed by scripts or with sigtool --info. There are two CVD databases in ClamAV: main.cvd and daily.cvd for daily updates. You can use sigtool to unpack a CVD file (--unpack) and to list virus names (--list-sigs).