Most of the options are simple switches which enable or disable some features. Options marked with [=yes/no(*)] can be optionally followed by =yes/=no; if they get called without the boolean argument the scanner will assume 'yes'. The asterisk marks the default internal setting for a given option.
.TP
\fB\-h, \-\-help\fR
Print help information and exit.
@ -60,7 +60,7 @@ Only scan file/directory names containing PATT. It may be used multiple times.
\fB\-i, \-\-infected\fR
Only print infected files.
.TP
\fB\-\-remove\fR
\fB\-\-remove[=yes/no(*)]\fR
Remove infected files. \fBBe careful.\fR
.TP
\fB\-\-move=DIRECTORY\fR
@ -69,7 +69,7 @@ Move infected files into DIRECTORY. Directory must be writable for the '@CLAMAVU
\fB\-\-copy=DIRECTORY\fR
Copy infected files into DIRECTORY. Directory must be writable for the '@CLAMAVUSER@' user or unprivileged user running clamscan.
.TP
\fB\-\-detect\-pua\fR
\fB\-\-detect\-pua[=yes/no(*)]\fR
Detect Possibly Unwanted Applications.
.TP
\fB\-\-exclude\-pua=CATEGORY\fR
@ -78,8 +78,8 @@ Exclude a specific PUA category. This option can be used multiple times. See htt
\fB\-\-include\-pua=CATEGORY\fR
Only include a specific PUA category. This option can be used multiple times. See http://www.clamav.net/support/pua for the complete list of PUA
.TP
\fB\-\-detect\-structured\fR
Enable the DLP (Data Loss Prevention) module which provides detection of SSN and Credit Card numbers.
\fB\-\-detect\-structured[=yes/no(*)]\fR
Use the DLP (Data Loss Prevention) module to detect SSN and Credit Card numbers inside documents/text files.
.TP
\fB\-\-structured\-ssn\-format=X\fR
X=0: search for valid SSNs formatted as xxx-yy-zzzz (normal); X=1: search for valid SSNs formatted as xxxyyzzzz (stripped); X=2: search for both formats. Default is 0.
@ -90,52 +90,52 @@ This option sets the lowest number of Social Security Numbers found in a file to
\fB\-\-structured\-cc\-count=#n\fR
This option sets the lowest number of Credit Card numbers found in a file to generate a detect (default: 3).
.TP
\fB\-\-no\-mail\fR
Disable scanning of mail files.
\fB\-\-scan\-mail[=yes(*)/no]\fR
Scan mail files.
.TP
\fB\-\-no\-phishing\-sigs\fR
Disable signature-based phishing detection.
\fB\-\-phishing\-sigs[=yes(*)/no]\fR
Use the signature-based phishing detection.
.TP
\fB\-\-no\-phishing\-scan\-urls\fR
Disable url-based heuristic phishing detection. This disables Phishing.Heuristics.Email.*
\fB\-\-phishing\-scan\-urls[=yes(*)/no]\fR
Use the url-based heuristic phishing detection (Phishing.Heuristics.Email.*)
.TP
\fB\-\-heuristic\-scan\-precedence\fR
\fB\-\-heuristic\-scan\-precedence[=yes/no(*)]\fR
Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time. When disabled, virus/phish detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phish, and a real malware, the real malware will be reported Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option.
.TP
\fB\-\-phishing\-ssl\fR
Always block SSL mismatches in URLs (might lead to false positives!).
\fB\-\-phishing\-ssl[=yes/no(*)]\fR
Block SSL mismatches in URLs (might lead to false positives!).
.TP
\fB\-\-phishing\-cloak\fR
Always block cloaked URLs (might lead to some false positives).
\fB\-\-phishing\-cloak[=yes/no(*)]\fR
Block cloaked URLs (might lead to some false positives).
.TP
\fB\-\-no\-algorithmic\fR
In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option disables the algorithmic detection.
\fB\-\-algorithmic\-detection[=yes(*)/no]\fR
In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option can be used to control the algorithmic detection.
.TP
\fB\-\-no\-pe\fR
PE stands for Portable Executable \- it's an executable file format used in all 32\-bit versions of Windows operating systems. By default ClamAV performs deeper analysis of executable files and attempts to decompress popular executable packers such as UPX, Petite, and FSG. This option \fBdisables\fR PE support and should be used with care!
\fB\-\-scan\-pe[=yes(*)/no]\fR
PE stands for Portable Executable \- it's an executable file format used in all 32\-bit versions of Windows operating systems. By default ClamAV performs deeper analysis of executable files and attempts to decompress popular executable packers such as UPX, Petite, and FSG.
.TP
\fB\-\-no\-elf\fR
Executable and Linking Format is a standard format for UN*X executables. This option \fBdisables\fR ELF support.
\fB\-\-scan\-elf[=yes(*)/no]\fR
Executable and Linking Format is a standard format for UN*X executables. This option controls the ELF support.
.TP
\fB\-\-no\-ole2\fR
Disable support for Microsoft Office documents and .msi files.
\fB\-\-scan\-ole2[=yes(*)/no]\fR
Scan Microsoft Office documents and .msi files.
.TP
\fB\-\-no\-pdf\fR
Disable scanning within PDF files.
\fB\-\-scan\-pdf[=yes(*)/no]\fR
Scan within PDF files.
.TP
\fB\-\-no\-html\fR
Disable support for HTML detection and normalisation.
\fB\-\-scan\-html[=yes(*)/no]\fR
Detect, normalize/decrypt and scan HTML files and embedded scripts.
.TP
\fB\-\-no\-archive\fR
Disable archive support built in libclamav.
\fB\-\-scan\-archive[=yes(*)/no]\fR
Scan archives supported by libclamav.
.TP
\fB\-\-detect\-broken\fR
\fB\-\-detect\-broken[=yes/no(*)]\fR
Mark broken executables as viruses (Broken.Executable).
.TP
\fB\-\-block\-encrypted\fR
\fB\-\-block\-encrypted[=yes/no(*)]\fR
Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
.TP
\fB\-\-mail\-follow\-urls\fR
\fB\-\-mail\-follow\-urls[=yes/no(*)]\fR
If an email contains URLs ClamAV can download and scan them. \fBWARNING: This option may open your system to a DoS attack. Never use it on loaded servers.\fR
{"PidFile","pid",'p',OPT_STRING,NULL,-1,NULL,0,OPT_CLAMD|OPT_FRESHCLAM|OPT_MILTER,"Save the process ID to a file.","/var/run/clamd.pid"},
{"TemporaryDirectory",NULL,0,OPT_STRING,NULL,-1,NULL,0,OPT_CLAMD|OPT_MILTER,"This option allows you to change the default temporary directory.","/tmp"},
{"TemporaryDirectory","tempdir",0,OPT_STRING,NULL,-1,NULL,0,OPT_CLAMD|OPT_MILTER|OPT_CLAMSCAN,"This option allows you to change the default temporary directory.","/tmp"},
{"DatabaseDirectory","datadir",0,OPT_STRING,NULL,-1,DATADIR,0,OPT_CLAMD|OPT_FRESHCLAM,"This option allows you to change the default database directory.\nIf you enable it, please make sure it points to the same directory in\nboth clamd and freshclam.","/var/lib/clamav"},
{"ExcludePath",NULL,0,OPT_STRING,NULL,-1,NULL,1,OPT_CLAMD,"Don't scan files/directories whose names match the provided\nregular expression. This option can be specified multiple times.","^/proc/"},
{"MaxDirectoryRecursion",NULL,0,OPT_NUMBER,MATCH_NUMBER,15,NULL,0,OPT_CLAMD,"Maximum depth the directories are scanned at.","15"},
{"MaxDirectoryRecursion","max-dir-recursion",0,OPT_NUMBER,MATCH_NUMBER,15,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Maximum depth the directories are scanned at.","15"},
{"ExcludePUA",NULL,0,OPT_STRING,NULL,-1,NULL,1,OPT_CLAMD,"Exclude a specific PUA category. This directive can be used multiple times.\nSee http://www.clamav.net/support/pua for the complete list of PUA\ncategories.","NetTool"},
{"ExcludePUA","exclude-pua",0,OPT_STRING,NULL,-1,NULL,1,OPT_CLAMD|OPT_CLAMSCAN,"Exclude a specific PUA category. This directive can be used multiple times.\nSee http://www.clamav.net/support/pua for the complete list of PUA\ncategories.","NetTool"},
{"IncludePUA",NULL,0,OPT_STRING,NULL,-1,NULL,1,OPT_CLAMD,"Only include a specific PUA category. This directive can be used multiple\ntimes.","Spy"},
{"IncludePUA","include-pua",0,OPT_STRING,NULL,-1,NULL,1,OPT_CLAMD|OPT_CLAMSCAN,"Only include a specific PUA category. This directive can be used multiple\ntimes.","Spy"},
{"AlgorithmicDetection",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"In some cases (eg. complex malware, exploits in graphic files, and others),\nClamAV uses special algorithms to provide accurate detection. This option\ncontrols the algorithmic detection.","yes"},
{"AlgorithmicDetection","algorithmic-detection",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"In some cases (eg. complex malware, exploits in graphic files, and others),\nClamAV uses special algorithms to provide accurate detection. This option\ncontrols the algorithmic detection.","yes"},
{"ScanPE",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"PE stands for Portable Executable - it's an executable file format used\nin all 32- and 64-bit versions of Windows operating systems. This option\nallows ClamAV to perform a deeper analysis of executable files and it's also\nrequired for decompression of popular executable packers such as UPX or FSG.","yes"},
{"ScanPE","scan-pe",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"PE stands for Portable Executable - it's an executable file format used\nin all 32- and 64-bit versions of Windows operating systems. This option\nallows ClamAV to perform a deeper analysis of executable files and it's also\nrequired for decompression of popular executable packers such as UPX or FSG.","yes"},
{"ScanELF",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"Executable and Linking Format is a standard format for UN*X executables.\nThis option allows you to control the scanning of ELF files.","yes"},
{"ScanELF","scan-elf",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Executable and Linking Format is a standard format for UN*X executables.\nThis option allows you to control the scanning of ELF files.","yes"},
{"DetectBrokenExecutables",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"With this option enabled clamav will try to detect broken executables\n(both PE and ELF) and mark them as Broken.Executable.","yes"},
{"DetectBrokenExecutables","detect-broken",0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"With this option enabled clamav will try to detect broken executables\n(both PE and ELF) and mark them as Broken.Executable.","yes"},
{"ScanMail",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"Enable the built in email scanner.","yes"},
{"ScanMail","scan-mail",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Enable the built in email scanner.","yes"},
{"MailFollowURLs",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"If an email contains URLs ClamAV can download and scan them.\nWARNING: This option may open your system to a DoS attack. Please don't use\nthis feature on highly loaded servers.","no"},
{"MailFollowURLs","mail-follow-urls",0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"If an email contains URLs ClamAV can download and scan them.\nWARNING: This option may open your system to a DoS attack. Please don't use\nthis feature on highly loaded servers.","no"},
{"ScanPartialMessages",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"Scan RFC1341 messages split over many emails. You will need to\nperiodically clean up $TemporaryDirectory/clamav-partial directory.\nWARNING: This option may open your system to a DoS attack. Please don't use\nthis feature on highly loaded servers.","no"},
{"PhishingSignatures",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"With this option enabled ClamAV will try to detect phishing attempts by using\nsignatures.","yes"},
{"PhishingSignatures","phishing-sigs",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"With this option enabled ClamAV will try to detect phishing attempts by using\nsignatures.","yes"},
{"PhishingScanURLs",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"Scan URLs found in mails for phishing attempts using heuristics.","yes"},
{"PhishingScanURLs","phishing-scan-urls",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Scan URLs found in mails for phishing attempts using heuristics.","yes"},
{"PhishingAlwaysBlockCloak",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"Always block cloaked URLs, even if they're not in the database.\nThis feature can lead to false positives.","no"},
{"PhishingAlwaysBlockCloak","phishing-cloak",0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Always block cloaked URLs, even if they're not in the database.\nThis feature can lead to false positives.","no"},
{"PhishingAlwaysBlockSSLMismatch",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"Always block SSL mismatches in URLs, even if they're not in the database.\nThis feature can lead to false positives.",""},
{"PhishingAlwaysBlockSSLMismatch","phishing-ssl",0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Always block SSL mismatches in URLs, even if they're not in the database.\nThis feature can lead to false positives.",""},
{"HeuristicScanPrecedence",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"Allow heuristic match to take precedence.\nWhen enabled, if a heuristic scan (such as phishingScan) detects\na possible virus/phish it will stop scan immediately. Recommended, saves CPU\nscan-time.\nWhen disabled, virus/phish detected by heuristic scans will be reported only\nat the end of a scan. If an archive contains both a heuristically detected\nvirus/phish, and a real malware, the real malware will be reported.\nKeep this disabled if you intend to handle \"*.Heuristics.*\" viruses\ndifferently from \"real\" malware.\nIf a non-heuristically-detected virus (signature-based) is found first,\nthe scan is interrupted immediately, regardless of this config option.","yes"},
{"HeuristicScanPrecedence","heuristic-scan-precedence",0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Allow heuristic match to take precedence.\nWhen enabled, if a heuristic scan (such as phishingScan) detects\na possible virus/phish it will stop scan immediately. Recommended, saves CPU\nscan-time.\nWhen disabled, virus/phish detected by heuristic scans will be reported only\nat the end of a scan. If an archive contains both a heuristically detected\nvirus/phish, and a real malware, the real malware will be reported.\nKeep this disabled if you intend to handle \"*.Heuristics.*\" viruses\ndifferently from \"real\" malware.\nIf a non-heuristically-detected virus (signature-based) is found first,\nthe scan is interrupted immediately, regardless of this config option.","yes"},
{"StructuredDataDetection",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"Enable the Data Loss Prevention module.","no"},
{"StructuredDataDetection","detect-structured",0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Enable the Data Loss Prevention module.","no"},
{"StructuredMinCreditCardCount",NULL,0,OPT_NUMBER,MATCH_NUMBER,3,NULL,0,OPT_CLAMD,"This option sets the lowest number of Credit Card numbers found in a file\nto generate a detect.","5"},
{"StructuredMinCreditCardCount","structured-cc-count",0,OPT_NUMBER,MATCH_NUMBER,3,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option sets the lowest number of Credit Card numbers found in a file\nto generate a detect.","5"},
{"StructuredMinSSNCount",NULL,0,OPT_NUMBER,MATCH_NUMBER,3,NULL,0,OPT_CLAMD,"This option sets the lowest number of Social Security Numbers found\nin a file to generate a detect.","5"},
{"StructuredMinSSNCount","structured-ssn-count",0,OPT_NUMBER,MATCH_NUMBER,3,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option sets the lowest number of Social Security Numbers found\nin a file to generate a detect.","5"},
{"StructuredSSNFormatNormal",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"With this option enabled the DLP module will search for valid\nSSNs formatted as xxx-yy-zzzz.","yes"},
{"StructuredSSNFormatStripped",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"With this option enabled the DLP module will search for valid\nSSNs formatted as xxxyyzzzz","no"},
{"ScanHTML",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"Perform HTML/JavaScript/ScriptEncoder normalisation and decryption.","yes"},
{"ScanHTML","scan-html",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Perform HTML/JavaScript/ScriptEncoder normalisation and decryption.","yes"},
{"ScanOLE2",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"This option enables scanning of OLE2 files, such as Microsoft Office\ndocuments and .msi files.","yes"},
{"ScanOLE2","scan-ole2",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option enables scanning of OLE2 files, such as Microsoft Office\ndocuments and .msi files.","yes"},
{"ScanPDF",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"This option enables scanning within PDF files.","yes"},
{"ScanPDF","scan-pdf",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option enables scanning within PDF files.","yes"},
{"ScanArchive",NULL,0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD,"Scan within archives and compressed files.","yes"},
{"ScanArchive","scan-archive",0,OPT_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Scan within archives and compressed files.","yes"},
{"ArchiveBlockEncrypted",NULL,0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).","no"},
{"ArchiveBlockEncrypted","block-encrypted",0,OPT_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).","no"},
{"MaxScanSize",NULL,0,OPT_SIZE,MATCH_SIZE,-1,NULL,0,OPT_CLAMD,"This option sets the maximum amount of data to be scanned for each input file.\nArchives and other containers are recursively extracted and scanned up to this\nvalue.\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe damage.","100M"},
{"MaxScanSize","max-scansize",0,OPT_SIZE,MATCH_SIZE,-1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option sets the maximum amount of data to be scanned for each input file.\nArchives and other containers are recursively extracted and scanned up to this\nvalue.\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe damage.","100M"},
{"MaxFileSize",NULL,0,OPT_SIZE,MATCH_SIZE,-1,NULL,0,OPT_CLAMD|OPT_MILTER,"Files larger than this limit won't be scanned. Affects the input file itself\nas well as files contained inside it (when the input file is an archive, a\ndocument or some other kind of container).\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe damage to the system.","25M"},
{"MaxFileSize","max-filesize",0,OPT_SIZE,MATCH_SIZE,-1,NULL,0,OPT_CLAMD|OPT_MILTER|OPT_CLAMSCAN,"Files larger than this limit won't be scanned. Affects the input file itself\nas well as files contained inside it (when the input file is an archive, a\ndocument or some other kind of container).\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe damage to the system.","25M"},
{"MaxRecursion",NULL,0,OPT_NUMBER,MATCH_NUMBER,-1,NULL,0,OPT_CLAMD,"Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR\nfile, all files within it will also be scanned. This option specifies how\ndeeply the process should be continued.\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe damage to the system.","16"},
{"MaxRecursion","max-recursion",0,OPT_NUMBER,MATCH_NUMBER,-1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR\nfile, all files within it will also be scanned. This option specifies how\ndeeply the process should be continued.\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe damage to the system.","16"},
{"MaxFiles",NULL,0,OPT_NUMBER,MATCH_NUMBER,-1,NULL,0,OPT_CLAMD,"Number of files to be scanned within an archive, a document, or any other\ncontainer file.\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe damage to the system.","10000"},
{"MaxFiles","max-files",0,OPT_NUMBER,MATCH_NUMBER,-1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Number of files to be scanned within an archive, a document, or any other\ncontainer file.\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe damage to the system.","10000"},
{"ClamukoScanOnAccess",NULL,0,OPT_BOOL,MATCH_BOOL,-1,NULL,0,OPT_CLAMD,"This option enables Clamuko. Dazuko needs to be already configured and\nrunning.","no"},
Tomasz Kojm
17 years ago