Changing numerous scan options' names, primarily those of heuristic signatature alert options. Original options (command line and clamd) will remain as deprecated & undocumented for a couple releases. Added 2 extra scan options to allow users to differentiate between alerting on encrypted archives vs encrypted documents (bb11911).
@ -316,16 +316,18 @@ Supported flags for each of the fields are as follows:
- **CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE**
Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time. When *disabled*, virus/phish detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phishing, and a real malware, the real malware will be reported.
- **CL_SCAN_HEURISTIC_ENCRYPTED**
With this flag the library will mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
- **CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE**
With this flag the library will mark encrypted archives as viruses (encrypted .zip, .7zip, .rar).
- **CL_SCAN_HEURISTIC_ENCRYPTED_DOC**
With this flag the library will mark encrypted docuemnts as viruses (encrypted .pdf).
- **CL_SCAN_HEURISTIC_BROKEN**
libclamav will try to detect broken executables and mark them as Broken.Executable.
- **CL_SCAN_HEURISTIC_EXCEEDS_MAX**
Alert when the scan of any file exceeds maximums such as max filesize, max scansize, max recursion level.
- **CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH**
Heuristic for Phishing module: always block SSL mismatches in URLs.
Heuristic for phishing module: alert on SSL mismatches in URLs.
- **CL_SCAN_HEURISTIC_PHISHING_CLOAK**
Phishing module: always block cloaked URLs.
Heuristic for phishing module: alert on cloaked URLs.
- **CL_SCAN_HEURISTIC_MACROS**
OLE2 containers, which contain VBA macros will be marked infected (Heuristics.OLE2.ContainsMacros).
@ -338,10 +338,15 @@ Only include a specific PUA category. This directive can be used multiple times.
.br
Default: disabled
.TP
\fBAlgorithmicDetection BOOL\fR
\fBHeuristicAlerts BOOL\fR
In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option controls the algorithmic detection.
.br
Default: yes
.TP
\fBHeuristicScanPrecedence BOOL\fR
Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phishing it will stop scanning immediately. Recommended, saves CPU scan-time. When disabled, virus/phishing detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phishing, and a real malware, the real malware will be reported. Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option.
.br
Default: no
.TP
\fBScanPE BOOL\fR
PE stands for Portable Executable \- it's an executable file format used in all 32 and 64\-bit versions of Windows operating systems. This option allows ClamAV to perform a deeper analysis of executable files and it's also required for decompression of popular executable packers such as UPX.
@ -357,11 +362,6 @@ If you turn off this option, the original files will still be scanned, but witho
.br
Default: yes
.TP
\fBDetectBrokenExecutables BOOL\fR
With this option clamd will try to detect broken executables (both PE and ELF) and mark them as Broken.Executable.
.br
Default: no
.TP
\fBScanMail BOOL\fR
Enable scanning of mail files.
.br
@ -375,35 +375,15 @@ Scan RFC1341 messages split over many emails. You will need to periodically clea
Default: no
.TP
\fBPhishingSignatures BOOL\fR
With this option enabled ClamAV will try to detect phishing attempts by using signatures.
Enable email signature-based phishing detection.
.br
Default: yes
.TP
\fBPhishingScanURLs BOOL\fR
Scan URLs found in mails for phishing attempts using heuristics. This will classify "Possibly Unwanted" phishing emails as Phishing.Heuristics.Email.*
Always block cloaked URLs, even if URL isn't in database. This can lead to false positives.
.br
Default: no
.TP
\fBPhishingAlwaysBlockSSLMismatch BOOL\fR
Always block SSL mismatches in URLs, even if the URL isn't in the database. This can lead to false positives.
.br
Default: no
.TP
\fBPartitionIntersection BOOL\fR
Detect partition intersections in raw disk images using heuristics.
.br
Default: no
.TP
\fBHeuristicScanPrecedence BOOL\fR
Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phishing it will stop scanning immediately. Recommended, saves CPU scan-time. When disabled, virus/phishing detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phishing, and a real malware, the real malware will be reported. Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option.
.br
Default: no
.TP
\fBStructuredDataDetection BOOL\fR
Enable the DLP module.
.br
@ -443,16 +423,6 @@ If you turn off this option, the original files will still be scanned, but witho
.br
Default: yes
.TP
\fBOLE2BlockMacros BOOL\fR
With this option enabled OLE2 files with VBA macros, which were not detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros".
.br
Default: no
.TP
\fBBlockMax BOOL\fR
Flag files with "Heuristics.Limits.Exceeded" when scanning is incomplete due to exceeding a scan or file size limit.
.br
Default: no
.TP
\fBScanPDF BOOL\fR
This option enables scanning within PDF files.
.br
@ -487,9 +457,49 @@ Scan within archives and compressed files.
If you turn off this option, the original files will still be scanned, but without unpacking and additional processing.
.br
Default: yes
.TP
\fBAlertBrokenExecutables BOOL\fR
Alert on broken executable files (PE & ELF).
.br
Default: no
.TP
\fBAlertEncrypted BOOL\fR
Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).
.br
Default: no
.TP
\fBAlertEncryptedArchive BOOL\fR
Alert on encrypted archives (encrypted .zip, .7zip, .rar).
.br
Default: no
.TP
\fBAlertEncryptedDoc BOOL\fR
Alert on encrypted documents (encrypted .pdf).
.br
Default: no
.TP
\fBAlertOLE2Macros BOOL\fR
Alert on OLE2 files containing VBA macros (Heuristics.OLE2.ContainsMacros).
.br
Default: no
.TP
\fBAlertExceedsMax BOOL\fR
Alert on files that exceed max file size, max scan size, or max recursion limit (Heuristics.Limits.Exceeded).
.br
Default: no
.TP
\fBAlertPhishingSSLMismatch BOOL\fR
Alert on emails containing SSL mismatches in URLs (might lead to false positives!).
.br
Default: no
.TP
\fBAlertPhishingCloak BOOL\fR
Alert on emails containing cloaked URLs (might lead to some false positives).
.br
Default: no
.TP
\fBArchiveBlockEncrypted BOOL\fR
Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
\fBAlertPartitionIntersection BOOL\fR
Alert on raw DMG image files containing partition intersections.
In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option can be used to control the algorithmic detection.
.TP
\fB\-\-heuristic\-scan\-precedence[=yes/no(*)]\fR
Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time. When disabled, virus/phish detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phish, and a real malware, the real malware will be reported Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option.
.TP
\fB\-\-phishing\-ssl[=yes/no(*)]\fR
Block SSL mismatches in URLs (might lead to false positives!).
.TP
\fB\-\-phishing\-cloak[=yes/no(*)]\fR
Block cloaked URLs (might lead to some false positives).
.TP
\fB\-\-partition\-intersection[=yes/no(*)]\fR
Detect partition intersections in raw disk images using heuristics.
.TP
\fB\-\-algorithmic\-detection[=yes(*)/no]\fR
In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option can be used to control the algorithmic detection.
.TP
\fB\-\-normalize[=yes(*)/no]\fR
Normalize (compress whitespace, downcase, etc.) html, script, and text files. Use normalize=no for yara compatibility.
.TP
@ -183,17 +174,32 @@ Scan HWP3 files. If you turn off this option, the original files will still be s
\fB\-\-scan\-archive[=yes(*)/no]\fR
Scan archives supported by libclamav. If you turn off this option, the original files will still be scanned, but without unpacking and additional processing.
.TP
\fB\-\-detect\-broken[=yes/no(*)]\fR
Mark broken executables as viruses (Broken.Executable).
\fB\-\-alert\-broken[=yes/no(*)]\fR
Alert on broken executable files (PE & ELF).
.TP
\fB\-\-alert\-encrypted[=yes/no(*)]\fR
Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).
.TP
\fB\-\-alert\-encrypted-archive[=yes/no(*)]\fR
Alert on encrypted archives (encrypted .zip, .7zip, .rar, .pdf).
.TP
\fB\-\-alert\-encrypted-doc[=yes/no(*)]\fR
Alert on encrypted documents (encrypted .zip, .7zip, .rar, .pdf).
.TP
\fB\-\-block\-encrypted[=yes/no(*)]\fR
Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
\fB\-\-alert\-macros[=yes/no(*)]\fR
Alert on OLE2 files containing VBA macros (Heuristics.OLE2.ContainsMacros).
.TP
\fB\-\-block\-macros[=yes/no(*)]\fR
Mark OLE2 files containing VBA macros as viruses (Heuristics.OLE2.ContainsMacros).
\fB\-\-alert\-exceeds\-max[=yes/no(*)]\fR
Alert on files that exceed max file size, max scan size, or max recursion limit (Heuristics.Limits.Exceeded).
.TP
\fB\-\-block\-max[=yes/no(*)]\fR
Flag files with "Heuristics.Limits.Exceeded" when scanning is incomplete due to exceeding a scan or file size limit.
\fB\-\-alert\-phishing\-ssl[=yes/no(*)]\fR
Alert on emails containing SSL mismatches in URLs (might lead to false positives!).
.TP
\fB\-\-alert\-phishing\-cloak[=yes/no(*)]\fR
Alert on emails containing cloaked URLs (might lead to some false positives).
Detect partition intersections in raw disk images using heuristics.
.TP
\fB\-\-max\-filesize=#n\fR
Extract and scan at most #n bytes from each archive. You may pass the value in kilobytes in format xK or xk, or megabytes in format xM or xm, where x is a number. This option protects your system against DoS attacks (default: 25 MB, max: <4 GB)
{"IncludePUA","include-pua",0,CLOPT_TYPE_STRING,NULL,-1,NULL,FLAG_MULTIPLE,OPT_CLAMD|OPT_CLAMSCAN,"Only include a specific PUA category. This directive can be used multiple\ntimes.","Spy\nScanner\nRAT"},
{"AlgorithmicDetection","algorithmic-detection",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"In some cases (eg. complex malware, exploits in graphic files, and others),\nClamAV uses special algorithms to provide accurate detection. This option\ncontrols the algorithmic detection.","yes"},
{"ScanPE","scan-pe",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"PE stands for Portable Executable - it's an executable file format used\nin all 32- and 64-bit versions of Windows operating systems. This option\nallows ClamAV to perform a deeper analysis of executable files and it's also\nrequired for decompression of popular executable packers such as UPX or FSG.\nIf you turn off this option, the original files will still be scanned, but\nwithout additional processing.","yes"},
{"ScanELF","scan-elf",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Executable and Linking Format is a standard format for UN*X executables.\nThis option allows you to control the scanning of ELF files.\nIf you turn off this option, the original files will still be scanned, but\nwithout additional processing.","yes"},
{"DetectBrokenExecutables","detect-broken",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"With this option enabled clamav will try to detect broken executables\n(both PE and ELF) and mark them as Broken.Executable.","yes"},
{"ScanMail","scan-mail",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Enable the built in email scanner.\nIf you turn off this option, the original files will still be scanned, but\nwithout parsing individual messages/attachments.","yes"},
{"ScanPartialMessages",NULL,0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD,"Scan RFC1341 messages split over many emails. You will need to\nperiodically clean up $TemporaryDirectory/clamav-partial directory.\nWARNING: This option may open your system to a DoS attack. Please don't use\nthis feature on highly loaded servers.","no"},
{"PhishingScanURLs","phishing-scan-urls",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Scan URLs found in mails for phishing attempts using heuristics.","yes"},
{"PhishingAlwaysBlockCloak","phishing-cloak",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Always block cloaked URLs, even if they're not in the database.\nThis feature can lead to false positives.","no"},
{"PhishingAlwaysBlockSSLMismatch","phishing-ssl",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Always block SSL mismatches in URLs, even if they're not in the database.\nThis feature can lead to false positives.",""},
{"PartitionIntersection","partition-intersection",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Detect partition intersections in raw disk images using heuristics.","yes"},
{"HeuristicAlerts","heuristic-alerts",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"In some cases (eg. complex malware, exploits in graphic files, and others),\nClamAV uses special algorithms to provide accurate detection. This option\ncontrols the algorithmic detection.","yes"},
{"HeuristicScanPrecedence","heuristic-scan-precedence",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Allow heuristic match to take precedence.\nWhen enabled, if a heuristic scan (such as phishingScan) detects\na possible virus/phish it will stop scan immediately. Recommended, saves CPU\nscan-time.\nWhen disabled, virus/phish detected by heuristic scans will be reported only\nat the end of a scan. If an archive contains both a heuristically detected\nvirus/phish, and a real malware, the real malware will be reported.\nKeep this disabled if you intend to handle \"*.Heuristics.*\" viruses\ndifferently from \"real\" malware.\nIf a non-heuristically-detected virus (signature-based) is found first,\nthe scan is interrupted immediately, regardless of this config option.","yes"},
{"ScanOLE2","scan-ole2",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option enables scanning of OLE2 files, such as Microsoft Office\ndocuments and .msi files.\nIf you turn off this option, the original files will still be scanned, but\nwithout additional processing.","yes"},
{"OLE2BlockMacros","block-macros",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"With this option enabled OLE2 files with VBA macros, which were not\ndetected by signatures will be marked as \"Heuristics.OLE2.ContainsMacros\".","no"},
{"AlertBrokenExecutables","alert-broken",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"With this option enabled clamav will try to detect broken executables\n(both PE and ELF) and alert on them with the Broken.Executable heuristic signature.","yes"},
{"AlertEncrypted","alert-encrypted",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).","no"},
{"AlertEncryptedArchive","alert-encrypted-archive",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Alert on encrypted archives (encrypted .zip, .7zip, .rar).","no"},
{"AlertEncryptedDoc","alert-encrypted-doc",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Alert on encrypted documents (encrypted .pdf).","no"},
{"AlertOLE2Macros","alert-macros",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"With this option enabled OLE2 files with VBA macros, which were not\ndetected by signatures will be marked as \"Heuristics.OLE2.ContainsMacros\".","no"},
{"AlertPhishingSSLMismatch","alert-phishing-ssl",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Alert on SSL mismatches in URLs, even if they're not in the database.\nThis feature can lead to false positives.",""},
{"AlertPhishingCloak","alert-phishing-cloak",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Alert on cloaked URLs, even if they're not in the database.\nThis feature can lead to false positives.","no"},
{"AlertPartitionIntersection","alert-partition-intersection",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Alert on raw DMG image files containing partition intersections.","yes"},
{"ScanPDF","scan-pdf",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option enables scanning within PDF files.\nIf you turn off this option, the original files will still be scanned, but\nwithout decoding and additional processing.","yes"},
{"ScanArchive","scan-archive",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Scan within archives and compressed files.\nIf you turn off this option, the original files will still be scanned, but\nwithout unpacking and additional processing.","yes"},
{"ArchiveBlockEncrypted","block-encrypted",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).","no"},
{"ForceToDisk","force-to-disk",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option causes memory or nested map scans to dump the content to disk.\nIf you turn on this option, more data is written to disk and is available\nwhen the leave-temps option is enabled at the cost of more disk writes.","no"},
{"MaxScanSize","max-scansize",0,CLOPT_TYPE_SIZE,MATCH_SIZE,CLI_DEFAULT_MAXSCANSIZE,NULL,0,OPT_CLAMD|OPT_CLAMSCAN,"This option sets the maximum amount of data to be scanned for each input file.\nArchives and other containers are recursively extracted and scanned up to this\nvalue.\nThe value of 0 disables the limit.\nWARNING: disabling this limit or setting it too high may result in severe\ndamage.","100M"},
{"DetectBrokenExecutables","detect-broken",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN|OPT_DEPRECATED,"Deprecated option to alert on broken PE and ELF executable files.","no"},
{"AlgorithmicDetection","algorithmic-detection",0,CLOPT_TYPE_BOOL,MATCH_BOOL,1,NULL,0,OPT_CLAMD|OPT_CLAMSCAN|OPT_DEPRECATED,"Deprecated option to enable heuristic alerts (e.g. \"Heuristics.<sig name>\")","no"},
{"PhishingAlwaysBlockSSLMismatch","phishing-ssl",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN|OPT_DEPRECATED,"Deprecated option to alert on SSL mismatches in URLs, even if they're not in the database.\nThis feature can lead to false positives.","no"},
{"PhishingAlwaysBlockCloak","phishing-cloak",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN|OPT_DEPRECATED,"Deprecated option to alert on cloaked URLs, even if they're not in the database.\nThis feature can lead to false positives.","no"},
{"PartitionIntersection","partition-intersection",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN|OPT_DEPRECATED,"Deprecated option to alert on raw DMG image files containing partition intersections.","no"},
{"OLE2BlockMacros","block-macros",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN|OPT_DEPRECATED,"With this option enabled OLE2 files with VBA macros, which were not\ndetected by signatures will be marked as \"Heuristics.OLE2.ContainsMacros\".","no"},
{"ArchiveBlockEncrypted","block-encrypted",0,CLOPT_TYPE_BOOL,MATCH_BOOL,0,NULL,0,OPT_CLAMD|OPT_CLAMSCAN|OPT_DEPRECATED,"Deprecated option to alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).","no"},
Micah Snyder (micasnyd)
7 years ago
committed by