ClamAV

Tip

sudo dnf install ~/Downloads/clamav-1.4.0.linux.x86_64.rpm

dnf info clamav

sudo dnf remove ~/Downloads/clamav-1.4.0.linux.x86_64.rpm

sudo apt install ~/Downloads/clamav-1.4.0.libnux.x86_64.deb

apt info clamav

sudo apt remove clamav

export PATH=/usr/local/clamav/bin:/usr/local/clamav/sbin:$PATH

sudo rm -rf /usr/local/clamav

gpg --import cisco-talos.gpg

gpg --verify clamav-X.XX.tar.gz.sig

    gpg: Signature made Wed Jan 24 19:31:26 2018 EST
    gpg:                using RSA key F13F9E16BCA5BFAD
    gpg: Good signature from "Talos (Talos, Cisco Systems Inc.) [email address]" [unknown]

  zypper install -y clamav

dnf install -y epel-release

dnf install -y clamav clamd clamav-update

emerge clamav

pkg install clamav

pkg install clamav-lts

  pkg_add clamav

  pkgin install clamav

pkgutil -i clamav

  installpkg clamav.tar.gz

  brew install clamav

  sudo port install clamav

docker build --tag "clamav:TICKET-123" .

docker pull clamav/clamav:unstable

docker run \
    --interactive \
    --tty \
    --rm \
    --name "clam_container_01" \
    clamav/clamav:unstable

docker run -it --rm \
    --name "clam_container_01" \
    clamav:TICKET-123

docker volume create clam_db

docker run -it --rm \
    --name "clam_container_01" \
    --mount source=clam_db,target=/var/lib/clamav \
    clamav/clamav:unstable_base

    --mount type=bind,source=/path/to/databases,target=/var/lib/clamav

docker run -it --rm \
    --name "clam_container_01" \
    --mount type=bind,source=/path/to/databases,target=/var/lib/clamav \
    clamav/clamav:unstable_base

docker run -it --rm \
      --user "clamav" \
      --entrypoint /init-unprivileged \
      --name "clam_container_01" \
    clamav/clamav:unstable_base

    --mount type=bind,source=/path/to/scan,target=/scandir
    --mount type=bind,source=/path/to/scan,target=/scandir

docker run -it --rm \
    --mount type=bind,source=/path/to/scan,target=/scandir \
    clamav/clamav:unstable \
    clamscan /scandir

docker run -it --rm \
    --mount type=bind,source=/path/to/scan,target=/scandir \
    --mount type=bind,source=/path/to/databases,target=/var/lib/clamav \
    clamav/clamav:unstable_base \
    clamscan /scandir

docker run -it --rm \
    --mount type=bind,source=/path/to/scan,target=/scandir \
    --mount type=bind,source=/var/lib/docker/data/clamav/sockets/,target=/run/clamav/ \
    clamav/clamav:unstable

docker run -it --rm \
    --mount type=bind,source=/path/to/scan,target=/scandir \
    --mount type=bind,source=/var/lib/docker/data/clamav/sockets/,target=/run/clamav/ \
    clamav/clamav:unstable_base \
    clamdscan /scandir

    --env 'CLAMAV_NO_MILTERD=false'

    --mount type=bind,source=/full/path/to/clamav/,target=/etc/clamav

docker exec --interactive --tty "clamav_container_01" clamdtop

docker exec --interactive --tty "clamav_container_01" /bin/sh

    --mount type=bind,source=/var/lib/docker/data/clamav/sockets/,target=/tmp/

clamdtop "/var/lib/docker/data/clamav/sockets/clamd.sock"

    --publish 13310:3310 \
    --publish 7357

    --publish 3310:3310 \
    --publish 7357:7357

docker volume create clam_db

docker run -it --rm \
    --name "clam_container_01" \
    --mount source=clam_db,target=/var/lib/clamav \
    --env 'CLAMAV_NO_FRESHCLAMD=true' \
    clamav/clamav:0.104_base

docker run -it --rm \
    --name "clam_container_02" \
    --mount source=clam_db,target=/var/lib/clamav \
    --env 'CLAMAV_NO_FRESHCLAMD=true' \
    clamav/clamav:0.104_base

docker exec -it clam_container_01 freshclam --on-update-execute=EXIT_1 || \
if [ $? == 1 ]; then \
    docker exec -it clam_container_01 clamdscan --reload; \
    docker exec -it clam_container_02 clamdscan --reload; \
fi

apk update && apk add \
  `# install tools` \
  g++ gcc gdb make cmake py3-pytest python3 valgrind \
  `# install clamav dependencies` \
  bzip2-dev check-dev curl-dev json-c-dev libmilter-dev libxml2-dev \
  linux-headers ncurses-dev openssl-dev pcre2-dev zlib-dev

apk add cargo rust

dnf install -y epel-release
dnf install -y dnf-plugins-core
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
dnf config-manager --set-enabled PowerTools | \
  dnf config-manager --set-enabled powertools | true

dnf install -y \
  `# install tools` \
  gcc gcc-c++ make python3 python3-pip valgrind \
  `# install clamav dependencies` \
  bzip2-devel check-devel json-c-devel libcurl-devel libxml2-devel \
  ncurses-devel openssl-devel pcre2-devel sendmail-devel zlib-devel

python3 -m pip install --user cmake pytest

python3 -m pip install cmake pytest

dnf install -y cargo rust

zypper install -y \
  `# install tools` \
  gcc gcc-c++ make python3 valgrind cmake python-pytest \
  `# install clamav dependencies` \
  libbz2-devel check-devel libjson-c-devel libcurl-devel libxml2-devel \
  ncurses-devel libopenssl-devel pcre2-devel sendmail-devel zlib-devel \

python3 -m pip install --user cmake

zypper install -y cargo rust

apt-get update && apt-get install -y \
  `# install tools` \
  gcc make pkg-config python3 python3-pip python3-pytest valgrind cmake \
  `# install clamav dependencies` \
  check libbz2-dev libcurl4-openssl-dev libjson-c-dev libmilter-dev \
  libncurses5-dev libpcre2-dev libssl-dev libxml2-dev zlib1g-dev

python3 -m pip install --user cmake

apt-get install -y cargo rustc

brew update

packages=(
  # install tools
  python3 cmake
  # install clamav dependencies
  bzip2 check curl-openssl json-c libxml2 ncurses openssl@1.1 pcre2 zlib
)
for item in "${packages[@]}"; do
  brew install $item || true; brew upgrade $item || brew upgrade $item
done

python3 -m pip install --user cmake pytest

pkg install -y \
  `# install tools` \
  gmake cmake pkgconf py38-pip python38 \
  `# install clamav dependencies` \
  bzip2 check curl json-c libmilter libxml2 ncurses pcre2

python3.8 -m pip install --user pytest

python3 -m pip install pytest

pkg install -y rust

tar xzf clamav-[ver].tar.gz
cd clamav-[ver]

mkdir build && cd build

cmake ..
cmake --build .
ctest
sudo cmake --build . --target install

cmake .. \
  -D CMAKE_INSTALL_PREFIX=/usr/local/clamav                                    \
  -D OPTIMIZE=OFF                                                              \
  -D OPENSSL_ROOT_DIR=/usr/local/opt/openssl@1.1/                              \
  -D OPENSSL_CRYPTO_LIBRARY=/usr/local/opt/openssl@1.1/lib/libcrypto.1.1.dylib \
  -D OPENSSL_SSL_LIBRARY=/usr/local/opt/openssl@1.1/lib/libssl.1.1.dylib
make
sudo make install

cmake .. \
    -D CMAKE_INSTALL_PREFIX=/usr \
    -D CMAKE_INSTALL_LIBDIR=lib \
    -D APP_CONFIG_DIRECTORY=/etc/clamav \
    -D DATABASE_DIRECTORY=/var/lib/clamav \
    -D ENABLE_JSON_SHARED=OFF
cmake --build .
ctest
sudo cmake --build . --target install

cmake .. -G Ninja \
    -D CMAKE_BUILD_TYPE=Debug \
    -D OPTIMIZE=OFF \
    -D CMAKE_INSTALL_PREFIX=`pwd`/install \
    -D ENABLE_EXAMPLES=ON \
    -D ENABLE_STATIC_LIB=ON \
    -D ENABLE_SYSTEMD=OFF
cmake --build .
ctest --verbose
cmake --build . --target install

xargs rm < install_manifest.txt

apk update && apk add \
  `# install tools` \
  g++ gcc gdb make valgrind \
  `# install clamav dependencies` \
  bzip2-dev check-dev curl-dev json-c-dev libmilter-dev libxml2-dev \
  linux-headers ncurses-dev openssl-dev pcre2-dev zlib-dev

dnf install -y epel-release
dnf install -y dnf-plugins-core
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
dnf config-manager --set-enabled PowerTools | \
  dnf config-manager --set-enabled powertools | true

dnf install -y \
  `# install tools` \
  gcc gcc-c++ make valgrind \
  `# install clamav dependencies` \
  bzip2-devel check-devel json-c-devel libcurl-devel libxml2-devel \
  ncurses-devel openssl-devel pcre2-devel sendmail-devel zlib-devel

apt-get update && apt-get install -y \
  `# install tools` \
  gcc make pkg-config valgrind \
  `# install clamav dependencies` \
  check libbz2-dev libcurl4-openssl-dev libjson-c-dev libmilter-dev \
  libncurses5-dev libpcre2-dev libssl-dev libxml2-dev zlib1g-dev

# Install XCode's Command Line Tools
xcode-select --install

brew update

packages=(
  # install tools
  autoconf automake m4
  # install clamav dependencies
  bzip2 check curl-openssl json-c libxml2 ncurses openssl@1.1 pcre2 zlib
)
for item in "${packages[@]}"; do
  brew install $item || true; brew upgrade $item || brew upgrade $item
done

pkg install -y \
  `# install tools` \
  gmake pkgconf \
  `# install clamav dependencies` \
  bzip2 check curl json-c libmilter libxml2 ncurses pcre2

tar xzf clamav-[ver].tar.gz
cd clamav-[ver]

mkdir build && cd build

../autogen.sh

../configure --help

../configure
make
make check VG=1
sudo make install

../configure \
    --prefix=/usr
    --sysconfdir=/etc/clamav \
    --with-dbdir=/var/lib/clamav \
    --with-libjson-static=/path/to/libjson-c.a \
    --enable-milter
make
make check VG=1
sudo make install

CFLAGS="-Wall -Wextra -ggdb -O0" CXXFLAGS="-Wall -Wextra -ggdb -O0" ../configure \
    --prefix=`pwd`/install \
    --with-systemdsystemunitdir=no
make -j12
make check VG=1
sudo make install

choco install cmake wixtoolset

choco install nasm activeperl

python3 -m pip install --user pytest

mkdir build && cd build

python3 -m pip install mussels

msl update
msl cookbook trust clamav

msl build clamav_deps

cmake ..  -G "Visual Studio 16 2019" -A x64 `
  -D JSONC_INCLUDE_DIR="$home\.mussels\install\x64\include\json-c"         `
  -D JSONC_LIBRARY="$home\.mussels\install\x64\lib\json-c.lib"             `
  -D ENABLE_JSON_SHARED=OFF                                              `
  -D BZIP2_INCLUDE_DIR="$home\.mussels\install\x64\include"                `
  -D BZIP2_LIBRARY_RELEASE="$home\.mussels\install\x64\lib\libbz2.lib"     `
  -D CURL_INCLUDE_DIR="$home\.mussels\install\x64\include"                 `
  -D CURL_LIBRARY="$home\.mussels\install\x64\lib\libcurl_imp.lib"         `
  -D OPENSSL_ROOT_DIR="$home\.mussels\install\x64"                         `
  -D OPENSSL_INCLUDE_DIR="$home\.mussels\install\x64\include"              `
  -D OPENSSL_CRYPTO_LIBRARY="$home\.mussels\install\x64\lib\libcrypto.lib" `
  -D OPENSSL_SSL_LIBRARY="$home\.mussels\install\x64\lib\libssl.lib"       `
  -D ZLIB_LIBRARY="$home\.mussels\install\x64\lib\libssl.lib"              `
  -D LIBXML2_INCLUDE_DIR="$home\.mussels\install\x64\include"              `
  -D LIBXML2_LIBRARY="$home\.mussels\install\x64\lib\libxml2.lib"          `
  -D PCRE2_INCLUDE_DIR="$home\.mussels\install\x64\include"                `
  -D PCRE2_LIBRARY="$home\.mussels\install\x64\lib\pcre2-8.lib"            `
  -D CURSES_INCLUDE_DIR="$home\.mussels\install\x64\include"               `
  -D CURSES_LIBRARY="$home\.mussels\install\x64\lib\pdcurses.lib"          `
  -D PThreadW32_INCLUDE_DIR="$home\.mussels\install\x64\include"           `
  -D PThreadW32_LIBRARY="$home\.mussels\install\x64\lib\pthreadVC2.lib"    `
  -D ZLIB_INCLUDE_DIR="$home\.mussels\install\x64\include"                 `
  -D ZLIB_LIBRARY="$home\.mussels\install\x64\lib\zlibstatic.lib"          `
  -D LIBCHECK_INCLUDE_DIR="$home\.mussels\install\x64\include"             `
  -D LIBCHECK_LIBRARY="$home\.mussels\install\x64\lib\checkDynamic.lib"    `
  -D CMAKE_INSTALL_PREFIX="install"

cmake --build . --config RelWithDebInfo

cmake --build . --config RelWithDebInfo -- /verbosity:detailed

ctest -C RelWithDebInfo

cmake --build . --config RelWithDebInfo --target install

    if (engine->stats_data)
        free(engine->stats_data);

$VCPKG_PATH="..." # Path to your vcpkg installation

$env:VCPKG_DEFAULT_TRIPLET="x64-windows"

& "$VCPKG_PATH\vcpkg" install 'curl[openssl]' 'json-c' 'libxml2' 'pcre2' 'pthreads' 'zlib' 'pdcurses' 'bzip2' 'check'

cmake .. -A x64 `
  -D CMAKE_TOOLCHAIN_FILE="$VCPKG_PATH\scripts\buildsystems\vcpkg.cmake" `
  -D CMAKE_INSTALL_PREFIX="install"

cmake --build . --config RelWithDebInfo

ctest -C RelWithDebInfo

cmake --build . --config RelWithDebInfo --target install

cpack -C RelWithDebInfo

groupadd clamav
useradd -g clamav -s /bin/false -c "Clam Antivirus" clamav

dscl . list /Groups PrimaryGroupID | tr -s ' ' | sort -n -t ' ' -k2,2

dscl . list /Users UniqueID | tr -s ' ' | sort -n -t ' ' -k2,2

sudo dscl . create /Groups/clamav
sudo dscl . create /Groups/clamav RealName "Clam Antivirus Group"
sudo dscl . create /Groups/clamav gid 799           # Ensure this is unique!
sudo dscl . create /Users/clamav
sudo dscl . create /Users/clamav RealName "Clam Antivirus User"
sudo dscl . create /Users/clamav UserShell /bin/false
sudo dscl . create /Users/clamav UniqueID 599       # Ensure this is unique!
sudo dscl . create /Users/clamav PrimaryGroupID 799 # Must match the above gid!

sudo chown -R clamav:clamav /usr/local/share/clamav

chown -R clamav:clamav /var/lib/clamav/

clamconf -g freshclam.conf > freshclam.conf
clamconf -g clamd.conf > clamd.conf
clamconf -g clamav-milter.conf > clamav-milter.conf

cp freshclam.conf.example freshclam.conf
cp clamd.conf.example clamd.conf
cp clamav-milter.conf.example clamav-milter.conf

copy .\conf_examples\freshclam.conf.sample .\freshclam.conf
copy .\conf_examples\clamd.conf.sample .\clamd.conf

write.exe .\freshclam.conf

write.exe .\clamd.conf

freshclam

touch /var/log/freshclam.log
chmod 600 /var/log/freshclam.log
chown clamav /var/log/freshclam.log

freshclam -d

N * * * *   /usr/local/bin/freshclam --quiet

HTTPProxyServer myproxyserver.com
HTTPProxyPort 1234
HTTPProxyUsername myusername
HTTPProxyPassword mypass

# Comment or remove the line below.
#Example

mv ./clamd.conf.example ./clamd.conf

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
LocalSocket /tmp/clamd.socket

...

# Sets the permissions on the unix socket to the specified mode.
# Default: disabled (socket is world accessible)
LocalSocketMode 660

man clamd.conf

./configure [options] --enable-milter

checking for mi_stop in -lmilter... no
configure: error: Cannot find libmilter

groupadd clamav
useradd -g clamav -s /bin/false -c "Clam Antivirus" clamav

sudo chown -R clamav:clamav /usr/local/share/clamav

During database load : LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Permission denied

setsebool -P antivirus_can_scan_system 1

clamconf

clamconf --help

man clamconf

freshclam

freshclam --help

man freshclam

freshclam

freshclam: error while loading shared libraries: libclamav.so.7: cannot open shared object   file: No such file or directory

sudo ldconfig

sigtool --unpack=FILE

grep "Win.Test.EICAR" ./*

sigtool --find="Win.Test.EICAR"

sigtool --help

man sigtool

clambc --help

man clambc

man clamd

clamd

clamdscan [*options*] [*file/directory/-*]

man clamdtop

clamdtop --help

su - clamav -c "/usr/local/bin/clamd

sudo clamonacc

sudo clamd

man clamscan

clamscan --help

clamscan [options] [file/directory/-]

clamscan .

clamscan --recursive .

clamscan --recursive /

clamscan.exe --recursive C:\

clamscan --memory

1. Open `clamd.conf` for editing
2. Specify the path(s) you would like to recursively watch by setting the `OnAccessIncludePath` option
3. Set `OnAccessPrevention` to `yes`
4. Check what username `clamd` is running under
5. Set `OnAccessExcludeUname` to `clamd`'s uname
6. Save your work and close `clamd.conf`

sudo clamonacc

1. Open `clamd.conf` for editing
2. Set the `ScanOnAccess` option to `yes`
3. Specify the path(s) you would like to recursively watch by setting the `OnAccessIncludePath` option
4. Set `OnAccessPrevention` to `yes`
6. Save your work and close `clamd.conf`

sudo clamd

cat /boot/config-<kernel_version> | grep FANOTIFY

CONFIG_FANOTIFY=y
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y

CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set

echo 524288 | sudo tee -a /proc/sys/fs/inotify/max_user_watches

    ScanOnAccess yes ## versions <= 0.101.x
    OnAccessMountPath /
    OnAccessExcludeRootUID yes
    OnAccessExcludeUname clamav ## versions >= 0.102

    ScanOnAccess yes ## versions <= 0.101.x
    OnAccessIncludePath /home
    OnAccessExcludePath /home/user2
    OnAccessExcludePath /home/user4
    OnAccessExcludeUname clamav ## versions >= 0.102

    ScanOnAccess yes ## versions <= 0.101.x
    OnAccessIncludePath /home/user/Downloads
    OnAccessExcludeUname clamav ## versions >= 0.102
    OnAccessPrevention yes
    OnAccessDisableDDD yes

clamd --install-service

clamd --uninstall-service

clamconf -n

zip -P virus -e file.zip file.ext

{platform}.{category}.{name}-{signature id}-{revision}

clamscan -d test.ldb text.exe
test.exe: Win.Malware.Agent.UNOFFICIAL FOUND

----------- SCAN SUMMARY -----------
Known viruses: 1
Engine version: 0.100.0
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 17.45 MB
Data read: 17.45 MB (ratio 1.00:1)
Time: 0.400 sec (0 m 0 s)

    $ clamscan --debug attachment.exe
    [...]
    LibClamAV debug: Recognized MS-EXE/DLL file
    LibClamAV debug: Matched signature for file type PE
    LibClamAV debug: File type: Executable

    LibClamAV debug: Machine type: 80386
    LibClamAV debug: NumberOfSections: 3
    LibClamAV debug: TimeDateStamp: Fri Jan 10 04:57:55 2003
    LibClamAV debug: SizeOfOptionalHeader: e0
    LibClamAV debug: File format: PE
    LibClamAV debug: MajorLinkerVersion: 6
    LibClamAV debug: MinorLinkerVersion: 0
    LibClamAV debug: SizeOfCode: 0x9000
    LibClamAV debug: SizeOfInitializedData: 0x1000
    LibClamAV debug: SizeOfUninitializedData: 0x1e000
    LibClamAV debug: AddressOfEntryPoint: 0x27070
    LibClamAV debug: BaseOfCode: 0x1f000
    LibClamAV debug: SectionAlignment: 0x1000
    LibClamAV debug: FileAlignment: 0x200
    LibClamAV debug: MajorSubsystemVersion: 4
    LibClamAV debug: MinorSubsystemVersion: 0
    LibClamAV debug: SizeOfImage: 0x29000
    LibClamAV debug: SizeOfHeaders: 0x400
    LibClamAV debug: NumberOfRvaAndSizes: 16
    LibClamAV debug: Subsystem: Win32 GUI
    LibClamAV debug: ------------------------------------
    LibClamAV debug: Section 0
    LibClamAV debug: Section name: UPX0
    LibClamAV debug: Section data (from headers - in memory)
    LibClamAV debug: VirtualSize: 0x1e000 0x1e000
    LibClamAV debug: VirtualAddress: 0x1000 0x1000
    LibClamAV debug: SizeOfRawData: 0x0 0x0
    LibClamAV debug: PointerToRawData: 0x400 0x400
    LibClamAV debug: Section's memory is executable
    LibClamAV debug: Section's memory is writeable
    LibClamAV debug: ------------------------------------
    LibClamAV debug: Section 1
    LibClamAV debug: Section name: UPX1
    LibClamAV debug: Section data (from headers - in memory)
    LibClamAV debug: VirtualSize: 0x9000 0x9000
    LibClamAV debug: VirtualAddress: 0x1f000 0x1f000
    LibClamAV debug: SizeOfRawData: 0x8200 0x8200
    LibClamAV debug: PointerToRawData: 0x400 0x400
    LibClamAV debug: Section's memory is executable
    LibClamAV debug: Section's memory is writeable
    LibClamAV debug: ------------------------------------
    LibClamAV debug: Section 2
    LibClamAV debug: Section name: UPX2
    LibClamAV debug: Section data (from headers - in memory)
    LibClamAV debug: VirtualSize: 0x1000 0x1000
    LibClamAV debug: VirtualAddress: 0x28000 0x28000
    LibClamAV debug: SizeOfRawData: 0x200 0x1ff
    LibClamAV debug: PointerToRawData: 0x8600 0x8600
    LibClamAV debug: Section's memory is writeable
    LibClamAV debug: ------------------------------------
    LibClamAV debug: EntryPoint offset: 0x8470 (33904)

    LibClamAV debug: ------------------------------------
    LibClamAV debug: EntryPoint offset: 0x8470 (33904)
    LibClamAV debug: UPX/FSG/MEW: empty section found - assuming
                    compression
    LibClamAV debug: UPX: bad magic - scanning for imports
    LibClamAV debug: UPX: PE structure rebuilt from compressed file
    LibClamAV debug: UPX: Successfully decompressed with NRV2B
    LibClamAV debug: UPX/FSG: Decompressed data saved in
                    /tmp/clamav-90d2d25c9dca42bae6fa9a764a4bcede
    LibClamAV debug: ***** Scanning decompressed file *****
    LibClamAV debug: Recognized MS-EXE/DLL file
    LibClamAV debug: Matched signature for file type PE

    LibClamAV debug: File type: Executable
    LibClamAV debug: Machine type: 80386
    LibClamAV debug: NumberOfSections: 3
    LibClamAV debug: TimeDateStamp: Thu Jan 27 11:43:15 2011
    LibClamAV debug: SizeOfOptionalHeader: e0
    LibClamAV debug: File format: PE
    LibClamAV debug: MajorLinkerVersion: 6
    LibClamAV debug: MinorLinkerVersion: 0
    LibClamAV debug: SizeOfCode: 0xc000
    LibClamAV debug: SizeOfInitializedData: 0x19000
    LibClamAV debug: SizeOfUninitializedData: 0x0
    LibClamAV debug: AddressOfEntryPoint: 0x7b9f
    LibClamAV debug: BaseOfCode: 0x1000
    LibClamAV debug: SectionAlignment: 0x1000
    LibClamAV debug: FileAlignment: 0x1000
    LibClamAV debug: MajorSubsystemVersion: 4
    LibClamAV debug: MinorSubsystemVersion: 0
    LibClamAV debug: SizeOfImage: 0x26000
    LibClamAV debug: SizeOfHeaders: 0x1000
    LibClamAV debug: NumberOfRvaAndSizes: 16
    LibClamAV debug: Subsystem: Win32 GUI
    LibClamAV debug: ------------------------------------
    LibClamAV debug: Section 0
    LibClamAV debug: Section name: .text
    LibClamAV debug: Section data (from headers - in memory)
    LibClamAV debug: VirtualSize: 0xc000 0xc000
    LibClamAV debug: VirtualAddress: 0x1000 0x1000
    LibClamAV debug: SizeOfRawData: 0xc000 0xc000
    LibClamAV debug: PointerToRawData: 0x1000 0x1000
    LibClamAV debug: Section contains executable code
    LibClamAV debug: Section's memory is executable
    LibClamAV debug: ------------------------------------
    LibClamAV debug: Section 1
    LibClamAV debug: Section name: .rdata
    LibClamAV debug: Section data (from headers - in memory)
    LibClamAV debug: VirtualSize: 0x2000 0x2000
    LibClamAV debug: VirtualAddress: 0xd000 0xd000
    LibClamAV debug: SizeOfRawData: 0x2000 0x2000
    LibClamAV debug: PointerToRawData: 0xd000 0xd000
    LibClamAV debug: ------------------------------------
    LibClamAV debug: Section 2
    LibClamAV debug: Section name: .data
    LibClamAV debug: Section data (from headers - in memory)
    LibClamAV debug: VirtualSize: 0x17000 0x17000
    LibClamAV debug: VirtualAddress: 0xf000 0xf000
    LibClamAV debug: SizeOfRawData: 0x17000 0x17000
    LibClamAV debug: PointerToRawData: 0xf000 0xf000
    LibClamAV debug: Section's memory is writeable
    LibClamAV debug: ------------------------------------
    LibClamAV debug: EntryPoint offset: 0x7b9f (31647)
    LibClamAV debug: Bytecode executing hook id 257 (0 hooks)
    attachment.exe: OK
    [...]

    LibClamAV debug: UPX/FSG/MEW: empty section found - assuming compression
    LibClamAV debug: FSG: found old EP @119e0
    LibClamAV debug: FSG: Unpacked and rebuilt executable saved in
    /tmp/clamav-f592b20f9329ac1c91f0e12137bcce6c

    ClamAV-VDB:build time:version:number of signatures:functionality level required:MD5 checksum:digital signature:builder name:build time (sec)

    zolw@localhost:/usr/local/share/clamav$ sigtool -i main.cvd
    File: main.cvd
    Build time: 09 Dec 2007 15:50 +0000
    Version: 45
    Signatures: 169676
    Functionality level: 21
    Builder: sven
    MD5: b35429d8d5d60368eea9630062f7c75a
    Digital signature: dxsusO/HWP3/GAA7VuZpxYwVsE9b+tCk+tPN6OyjVF/U8
    JVh4vYmW8mZ62ZHYMlM903TMZFg5hZIxcjQB3SX0TapdF1SFNzoWjsyH53eXvMDY
    eaPVNe2ccXLfEegoda4xU2TezbGfbSEGoU1qolyQYLX674sNA2Ni6l6/CEKYYh
    Verification OK.

    $ mkdir /tmp/clamav-sigs
    $ cd /tmp/clamav-sigs/
    $ sigtool --unpack /var/lib/clamav/main.cvd
    $ ls
    COPYING   main.fp   main.hsb   main.mdb  main.ndb
    main.crb  main.hdb  main.info  main.msb  main.sfp

name:size:sha256

Category:Flags:StartFlevel:EndFlevel

#define OTHER_CONF_UUENC        0x1     // Default: 1
#define OTHER_CONF_SCRENC       0x2     // Default: 1
#define OTHER_CONF_RIFF         0x4     // Default: 1
#define OTHER_CONF_JPEG         0x8     // Default: 1
#define OTHER_CONF_CRYPTFF      0x10    // Default: 1
#define OTHER_CONF_DLP          0x20    // Default: 1
#define OTHER_CONF_MYDOOMLOG    0x40    // Default: 1
#define OTHER_CONF_PREFILTERING 0x80    // Default: 1
#define OTHER_CONF_PDFNAMEOBJ   0x100   // Default: 1
#define OTHER_CONF_PRTNINTXN    0x200   // Default: 1
#define OTHER_CONF_LZW          0x400   // Default: 1

0110 1111 1111
   ^pdfnameobj off

OTHER:0x6FF:90:99

Name;Trusted;Subject;Serial;Pubkey;Exponent;CodeSign;TimeSign;CertSign;
NotBefore;Comment[;minFL[;maxFL]]

magictype:offset:magicbytes:name:rtype:type[:min_flevel[:max_flevel]]

sigtool --md5 /path/to/false/positive/file >> /path/to/databases/false-positives.fp

sigtool --sha256 /path/to/false/positive/file >> /path/to/databases/false-positives.sfp

❯ clamscan ~/Downloads/eicar.com
/mnt/c/Users/micah/Downloads/eicar.com: Win.Test.EICAR_HDB-1 FOUND

...

❯ sigtool --sha256 ~/Downloads/eicar.com >> /var/lib/clamav/false-positives.sfp

❯ clamscan ~/Downloads/eicar.com
/mnt/c/Users/micah/Downloads/eicar.com: OK
...

Eicar-Test-Signature

Eicar-Test-Signature:bc356bae4c42f19a3de16e333ba3569c

zolw@localhost:/tmp/test$ sigtool --md5 test.exe > test.hdb
zolw@localhost:/tmp/test$ cat test.hdb
48c4533230e1ae1c118c741c0db19dfb:17387:test.exe

zolw@localhost:/tmp/test$ clamscan -d test.hdb test.exe
test.exe: test.exe FOUND

----------- SCAN SUMMARY -----------
Known viruses: 1
Scanned directories: 0
Engine version: 0.92.1
Scanned files: 1
Infected files: 1
Data scanned: 0.02 MB
Time: 0.024 sec (0 m 0 s)

HashString:FileSize:MalwareName

PESectionSize:PESectionHash:MalwareName

sigtool --mdb /path/to/32bit/PE/file

❯ ./sigtool/sigtool --mdb ~/Downloads/ChromeSetup.exe
LibClamAV debug: cli_peheader: SizeOfHeader is not aligned to the SectionAlignment
LibClamAV debug: Section{0}: 83456:83620eda4d054fe35c19faaa89d515f3
LibClamAV debug: Section{1}: 28160:ebb39bf5679d566074c9666fd9548d22
LibClamAV debug: Section{2}: 2560:3cbd45b86866e61bd3cbd759aa40888d
LibClamAV debug: Section{3}: 1199616:6555d93d90a4642c9b3feb4bdb075ec1
LibClamAV debug: Section{4}: 4608:80335bb2fda8c0e537fcf4d0af14bc89
LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0
LibClamAV debug: Cleaning up phishcheck
LibClamAV debug: Phishcheck cleaned up

PEImportTableHash:PEImportTableSize:MalwareName

f93b5d76132f6e6068946ec238813ce1:154:calc.exe
1ac946b228ebba41514c52672b33d623:140:calc64.exe

sigtool --imp /path/to/32bit/PE/file

❯ ./sigtool/sigtool --imp ./unit_tests/input/clamav_hdb_scanfiles/clam.exe
LibClamAV debug: cli_peheader: SizeOfHeader is not aligned to the SectionAlignment
LibClamAV debug: Imphash: 98c88d882f01a3f6ac1e5f7dfd761624:39
LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0
LibClamAV debug: Cleaning up phishcheck
LibClamAV debug: Phishcheck cleaned up

98c88d882f01a3f6ac1e5f7dfd761624:39:clam.exe

HashString:*:MalwareName:73

*:PESectionHash:MalwareName:73

zolw@localhost:/tmp/test$ sigtool --hex-dump
How do I look in hex?
486f7720646f2049206c6f6f6b20696e206865783f0a

testsig;Target:0;0;64[4-4]61616161{2}6262[3-6]65:27

SignatureName;TargetDescriptionBlock;LogicalExpression;Subsig0;
Subsig1;Subsig2;...

Sig1;Target:0;(0&1&2&3)&(4|1);6b6f74656b;616c61;7a6f6c77;7374656
6616e;deadbeef

Sig2;Target:0;((0|1|2)>5,2)&(3|1);6b6f74656b;616c61;7a6f6c77;737
46566616e

Sig3;Target:0;((0|1|2|3)=2)&(4|1);6b6f74656b;616c61;7a6f6c77;737
46566616e;deadbeef

Sig4;Engine:51-255,Target:1;((0|1)&(2|3))&4;EP+123:33c06834f04100
f2aef7d14951684cf04100e8110a00;S2+78:22??232c2d252229{-15}6e6573
(63|64)61706528;S3+50:68efa311c3b9963cb1ee8e586d32aeb9043e;f9c58
dcf43987e4f519d629b103375;SL+550:6300680065005c0046006900

clamav-nocase-A;Engine:81-255,Target:0;0&1;41414141::i;424242424242::i

clamav-fullword-A;Engine:81-255,Target:0;0&1;414141;68656c6c6f::f

clamav-fullword-B;Engine:81-255,Target:0;0&1;414141;68656c6c6f::fi

clamav-wide-B2;Engine:81-255,Target:0;0&1;414141;68656c6c6f::wa

clamav-wide-C0;Engine:81-255,Target:0;0&1;414141;68656c6c6f::iwfa

test.ldb:
    TestMacro;Engine:51-255,Target:0;0&1;616161;${6-7}12$

test.ndb:
    D1:0:$12:626262
    D2:0:$12:636363
    D3:0:$30:626264

TestMacro;Engine:51-255,Target:0;0;616161{3-4}(626262|636363)

Find.All.ClamAV;Engine:81-255,Target:0;1;6265676c6164697427736e6f7462797465636f6465;0/clamav/g

Find.ClamAV.OnlyAt.299;Engine:81-255,Target:0;2;7374756c747a67657473;7063726572656765786c6f6c;299:0&1/clamav/

Find.ClamAV.StartAt.300;Engine:81-255,Target:0;3;616c61696e;62756731393238;636c6f736564;300:0&1&2/clamav/r

Find.All.Encompassed.ClamAV;Engine:81-255,Target:0;3;7768796172656e2774;796f757573696e67;79617261;200,300:0&1&2/clamav/ge

Named.CapGroup.Pcre;Engine:81-255,Target:0;3;636f75727479617264;616c62756d;74657272696572;50:0&1&2/variable=(?&lt;nilshell&gt;.{16})end/gr

Firefox.TreeRange.UseAfterFree;Engine:81-255,Target:0,Engine:81-255;0&1&2;2e766965772e73656c656374696f6e;2e696e76616c696461746553656c656374696f6e;0&1/\x2Eview\x2Eselection.*?\x2Etree\s*\x3D\s*null.*?\x2Einvalidate/smi

Firefox.IDB.UseAfterFree;Engine:81-255,Target:0;0&1;4944424b657952616e6765;0/^\x2e(only|lowerBound|upperBound|bound)\x28.*?\x29.*?\x2e(lower|upper|lowerOpen|upperOpen)/smi

Firefox.boundElements;Engine:81-255,Target:0;0&1&2;6576656e742e6
26f756e64456c656d656e7473;77696e646f772e636c6f7365;0&1/on(load|click)\s*=\s*\x22?window\.close\s*\x28/si

logo.png;Engine:150-255,Target:0;0;fuzzy_img#af2ad01ed42993c7#0

logo.png;Engine:150-255,Target:0;0;fuzzy_img#af2ad01ed42993c7

logo.png-2;Engine:150-255,Target:0;0&1;49484452;fuzzy_img#af2ad01ed42993c7

logo.png;Engine:150-255,Target:0,Container:CL_TYPE_HTML;0;fuzzy_img#af2ad01ed42993c7
logo.png;Engine:150-255,Target:0,Container:CL_TYPE_MAIL;0;fuzzy_img#af2ad01ed42993c7

clamscan --gen-json --debug /path/to/file

[...]
Recognized MS-EXE/DLL file
in cli_peheader
versioninfo_cb: type: 10, name: 1, lang: 410, rva: 9608
cli_peheader: parsing version info @ rva 9608 (1/1)
VersionInfo (d2de): 'CompanyName'='Microsoft Corporation' -
VI:43006f006d00700061006e0079004e0061006d006500000000004d006900
630072006f0073006f0066007400200043006f00720070006f0072006100740
069006f006e000000
VersionInfo (d32a): 'FileDescription'='Entertainment Pack
FreeCell Game' - VI:460069006c006500440065007300630072006900700
0740069006f006e000000000045006e007400650072007400610069006e006d
0065006e00740020005000610063006b0020004600720065006500430065006
c006c002000470061006d0065000000
VersionInfo (d396): 'FileVersion'='5.1.2600.0 (xpclient.010817
-1148)' - VI:460069006c006500560065007200730069006f006e00000000
0035002e0031002e0032003600300030002e003000200028007800700063006
c00690065006e0074002e003000310030003800310037002d00310031003400
380029000000
VersionInfo (d3fa): 'InternalName'='freecell' - VI:49006e007400
650072006e0061006c004e0061006d006500000066007200650065006300650
06c006c000000
VersionInfo (d4ba): 'OriginalFilename'='freecell' - VI:4f007200
6900670069006e0061006c00460069006c0065006e0061006d0065000000660
0720065006500630065006c006c000000
VersionInfo (d4f6): 'ProductName'='Sistema operativo Microsoft
Windows' - VI:500072006f0064007500630074004e0061006d00650000000
000530069007300740065006d00610020006f00700065007200610074006900
76006f0020004d006900630072006f0073006f0066007400ae0020005700690
06e0064006f0077007300ae000000
VersionInfo (d562): 'ProductVersion'='5.1.2600.0' - VI:50007200
6f006400750063007400560065007200730069006f006e00000035002e00310
02e0032003600300030002e0030000000
[...]

my_test_vi_sig:1:VI:paste_your_hex_sig_here

echo hex_string | xxd -r -p | strings -el

echo 460069006c0065004400650073006300720069007000740069006f006e000000000045006e007400650072007400610069006e006d0065006e00740020005000610063006b0020004600720065006500430065006c006c00200047006100
6d0065000000 | xxd -r -p | strings -el
FileDescription
Entertainment Pack FreeCell Game

ICONNAME:GROUP1:GROUP2:ICON_HASH

LibClamAV debug: ICO SIGNATURE:
ICON_NAME:GROUP1:GROUP2:18e2e0304ce60a0cc3a09053a30000414100057e000afe0000e 80006e510078b0a08910d11ad04105e0811510f084e01040c080a1d0b0021000a39002a41

MalwareName:TargetType:Offset:HexSignature[:min_flevel:[max_flevel]]

rule CheckFileSize
{
  strings:
    $abc = "abc"
  condition:
    ($abc or not $abc) and filesize < 200KB
}

LibClamAV info: Suspicious link found!
LibClamAV info:   Real URL:    https://someshadywebsite.example.com
LibClamAV info:   Display URL: https://www.amazon.com
/path/to/suspicious/email.eml: Heuristics.Phishing.Email.SpoofedDomain FOUND

R:DisplayedURL[:FuncLevelSpec]
H:DisplayedHostname[:FuncLevelSpec]

S:P:HostPrefix[:FuncLevelSpec]
S:F:Sha256hash[:FuncLevelSpec]
S1:P:HostPrefix[:FuncLevelSpec]
S1:F:Sha256hash[:FuncLevelSpec]
S2:P:HostPrefix[:FuncLevelSpec]
S2:F:Sha256hash[:FuncLevelSpec]
S:W:Sha256hash[:FuncLevelSpec]

X:RealURL:DisplayedURL[:FuncLevelSpec]
M:RealHostname:DisplayedHostname[:FuncLevelSpec]

H:amazon.com

H:amazon.co.uk

R:.+\.amazon\.(com|co\.uk)([/?].*)?

H:amazon.co.uk:20-30

H:amazon.co.uk:20-

H:amazon.co.uk:0-20

X:.+\.amazon\.(at|ca|co\.uk|co\.jp|de|fr)([/?].*)?:.+\.amazon\.com([/?].*)?:17-

.+\.amazon\.(at|ca|co\.uk|co\.jp|de|fr)([/?].*)?:.+\.amazon\.com([/?].*)?/

<html>
<a href="http://1.realurl.example.com/">
  1.displayedurl.example.com
</a>
<a href="http://2.realurl.example.com">
  2 d<b>i<p>splayedurl.e</b>xa<i>mple.com
</a>
<a href="http://3.realurl.example.com">
  3.nested.example.com
  <a href="http://4.realurl.example.com">
    4.displayedurl.example.com
  </a>
</a>
<form action="http://5.realurl.example.com">
  sometext
  <img src="http://5.displayedurl.example.com/img0.gif"/>
  <a href="http://5.form.nested.displayedurl.example.com">
    5.form.nested.link-displayedurl.example.com
  </a>
</form>
<a href="http://6.realurl.example.com">
  6.displ
  <img src="6.displayedurl.example.com/img1.gif"/>
  ayedurl.example.com
</a>
<a href="http://7.realurl.example.com">
  <iframe src="http://7.displayedurl.example.com">
</a>

http://1.realurl.example.com/
1.displayedurl.example.com

http://2.realurl.example.com
2displayedurl.example.com

http://3.realurl.example.com
3.nested.example.com

http://4.realurl.example.com
4.displayedurl.example.com

http://5.realurl.example.com
http://5.displayedurl.example.com/img0.gif

http://5.realurl.example.com
http://5.form.nested.displayedurl.example.com

http://5.form.nested.displayedurl.example.com
5.form.nested.link-displayedurl.example.com

http://6.realurl.example.com
6.displayedurl.example.com

http://6.realurl.example.com
6.displayedurl.example.com/img1.gif

M:www.google.ro:www.google.com

<a href=”evilurl”>www.paypal.com</a>
<a href=”evilurl2” title=”www.ebay.com”>click here to sign in</a>
<form action=”evilurl_form”>
Please sign in to <a href=”cgi.ebay.com”>Ebay</a>using this form
<input type=’text’ name=’username’>Username</input>
....
</form>
<a href=”evilurl”><img src=”images.paypal.com/secure.jpg”></a>

www.google.com

*www\(\backslash\).google\(\backslash\).(com|ro|it) (\[a-zA-Z\])+\(\backslash\).google\(\backslash\).(com|ro|it)*

( CLEANUP_URL | CHECK_SSL | CHECK_CLOAKING | CHECK_IMG_URL )

R102 www.ebay.com .+

<a href=''http://69.0.241.57/bCentral/L.asp?L=XXXXXXXX''>`
  http://www.bcentral.it/`
</a>`

R http://www\(\backslash\).bcentral\(\backslash\).it/.+
http://69\(\backslash\).0\(\backslash\).241\(\backslash\).57/bCentral/L\(\backslash\).asp?L=.+

R .+ .+\(\backslash\).paypal\(\backslash\).com

$clamscan/clamscan --debug undetected.eml | less

    VirusName:ContainerType:ContainerSize:FileNameREGEX:
    FileSizeInContainer:FileSizeReal:IsEncrypted:FilePos:
    Res1:Res2[:MinFL[:MaxFL]]

SignatureName;TargetDescriptionBlock;PWStorageType;Password

{platform}.{category}.{name}-{signature id}-{revision}

git clone <paste that Git URL>
cd clamav-YourNameHere

git checkout -b issue-####-short-description

git add -u
git commit

git push -u origin <the_name_of_your_branch>

git remote add upstream git@github.com:Cisco-Talos/clamav.git

git fetch upstream
git rebase upstream/main

git clone https://github.com/Cisco-Talos/clamav.git

fetch = +refs/pull/*/head:refs/remotes/origin/PR-*

fetch = +refs/pull-requests/*/from:refs/remotes/origin/PR-*

fetch = +refs/merge-requests/*/head:refs/remotes/origin/PR-*

git fetch
git checkout PR-#

choco install cmake

choco install wixtoolset

choco install winflexbison

choco install activeperl nasm

    if (engine->stats_data)
        free(engine->stats_data);

git clone https://github.com/Cisco-Talos/clamav.git
cd clamav

git clone https://github.com/<yourusername>/clamav.git clamav-fork
cd clamav-fork

cmake .. -G Ninja                   \
    -D CMAKE_BUILD_TYPE="Debug"     \
    -D OPTIMIZE=OFF                 \
    -D CMAKE_INSTALL_PREFIX=install \
    -D ENABLE_MILTER=ON             \
    -D ENABLE_EXAMPLES=ON           \
    -D ENABLE_STATIC_LIB=ON         \
    -D ENABLE_SYSTEMD=OFF

ninja

ninja install

$VCPKG_PATH="..." # Path to your vcpkg installation

$env:VCPKG_DEFAULT_TRIPLET="x64-windows"

& "$VCPKG_PATH\vcpkg" install 'curl[openssl]' 'json-c' 'libxml2' 'pcre2' 'pthreads' 'zlib' 'pdcurses' 'bzip2' 'check'

pushd "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\Tools"
cmd /c "VsDevCmd.bat -arch=amd64 & set" |
foreach {
  if ($_ -match "=") {
    $v = $_.split("="); set-item -force -path "ENV:\$($v[0])"  -value "$($v[1])"
  }
}
popd
Write-Host "`nVisual Studio 2019 Command Prompt variables set." -ForegroundColor Yellow

cmake .. -G Ninja                                                          `
    -D CMAKE_BUILD_TYPE="Debug"                                             `
    -D CMAKE_TOOLCHAIN_FILE="$VCPKG_PATH\scripts\buildsystems\vcpkg.cmake"  `
    -D CMAKE_INSTALL_PREFIX="install"

ninja

ninja install

python3 -m pip install --user mussels

# This requires Git, and will clone the the "clamav" and "scrapbook" cookbooks.
msl up

# This is to enable running the scripts in the clamav cookbook to build the clamav dependencies.
msl cookbook trust -y clamav

# This is just to get you in a small directory so Mussels don't spend forever searching your harddrive for build recipes.
mkdir tmp && cd tmp

# First try a dry-run. If you're missing any tools, it will tell you.
# If you have everything, it will give you a list of the order it plans to build everything.
msl build clamav_deps --dry-run

# Then do the build.
msl build clamav_deps

# You could also have it build clamav for you too, but that's not so useful for development work.
msl build clamav

pushd "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\Tools"
cmd /c "VsDevCmd.bat -arch=amd64 & set" |
foreach {
  if ($_ -match "=") {
    $v = $_.split("="); set-item -force -path "ENV:\$($v[0])"  -value "$($v[1])"
  }
}
popd
Write-Host "`nVisual Studio 2019 Command Prompt variables set." -ForegroundColor Yellow

cmake ..  -G Ninja -D CMAKE_BUILD_TYPE="Debug" `
     -D ENABLE_EXAMPLES=OFF                                                 `
     -D JSONC_INCLUDE_DIR="$home\.mussels\install\x64\include\json-c"         `
     -D JSONC_LIBRARY="$home\.mussels\install\x64\lib\json-c.lib"             `
     -D ENABLE_JSON_SHARED=OFF                                              `
     -D BZIP2_INCLUDE_DIR="$home\.mussels\install\x64\include"                `
     -D BZIP2_LIBRARY_RELEASE="$home\.mussels\install\x64\lib\libbz2.lib"     `
     -D CURL_INCLUDE_DIR="$home\.mussels\install\x64\include"                 `
     -D CURL_LIBRARY="$home\.mussels\install\x64\lib\libcurl_imp.lib"         `
     -D OPENSSL_ROOT_DIR="$home\.mussels\install\x64"                         `
     -D OPENSSL_INCLUDE_DIR="$home\.mussels\install\x64\include"              `
     -D OPENSSL_CRYPTO_LIBRARY="$home\.mussels\install\x64\lib\libcrypto.lib" `
     -D ZLIB_LIBRARY="$home\.mussels\install\x64\lib\libssl.lib"              `
     -D LIBXML2_INCLUDE_DIR="$home\.mussels\install\x64\include\libxml2"      `
     -D LIBXML2_LIBRARY="$home\.mussels\install\x64\lib\libxml2.lib"          `
     -D PCRE2_INCLUDE_DIR="$home\.mussels\install\x64\include"                `
     -D PCRE2_LIBRARY="$home\.mussels\install\x64\lib\pcre2-8.lib"            `
     -D CURSES_INCLUDE_DIR="$home\.mussels\install\x64\include"               `
     -D CURSES_LIBRARY="$home\.mussels\install\x64\lib\pdcurses.lib"          `
     -D PThreadW32_INCLUDE_DIR="$home\.mussels\install\x64\include"           `
     -D PThreadW32_LIBRARY="$home\.mussels\install\x64\lib\pthreadVC2.lib"    `
     -D ZLIB_INCLUDE_DIR="$home\.mussels\install\x64\include"                 `
     -D ZLIB_LIBRARY="$home\.mussels\install\x64\lib\zlibstatic.lib"          `
     -D LIBCHECK_INCLUDE_DIR="$home\.mussels\install\x64\include"             `
     -D LIBCHECK_LIBRARY="$home\.mussels\install\x64\lib\checkDynamic.lib"    `
     -D CMAKE_INSTALL_PREFIX="install"

ninja

ninja install

./autogen.sh

dnf/yum install -y \
  autoconf autoreconf automake libtool libtool-ltdl-devel m4 pkg-config

apt-get install -y \
  autoconf autoconf-archive automake libtool libltdl-dev m4 pkg-config

mkdir build
cd build

CFLAGS="-ggdb -O0" CXXFLAGS="-ggdb -O0" OBJCFLAGS="-ggdb -O0" ../configure

CFLAGS="-ggdb -O0" CXXFLAGS="-ggdb -O0" OBJCFLAGS="-ggdb -O0" ../configure --prefix=`pwd`/../installed --enable-debug --enable-check --enable-coverage --enable-libjson --with-systemdsystemunitdir=no --enable-experimental --enable-clamdtop --enable-xml --enable-pcre --enable-llvm --with-system-llvm=no

make -j2
make install

cd ..
./installed/bin/clamscan

python3 -m pip install --user mussels

# This requires Git, and will clone the the "clamav" and "scrapbook" cookbooks.
msl up

# This is to enable running the scripts in the clamav cookbook to build the clamav dependencies.
msl cookbook trust -y clamav

# This is just to get you in a small directory so Mussels don't spend forever searching your harddrive for build recipes.
mkdir tmp && cd tmp

# First try a dry-run. If you're missing any tools, it will tell you.
# If you have everything, it will give you a list of the order it plans to build everything.
msl build -t host-static clamav_deps --dry-run

# Then do the build.
msl build -t host-static clamav_deps

RuntimeError: Click will abort further execution because Python was configured to use ASCII as encoding for the environment. Consult https://click.palletsprojects.com/unicode-support/ for mitigation steps.

This system lists some UTF-8 supporting locales that you can pick from. The following suitable locales were discovered: en_AG.utf8, en_AU.utf8, en_BW.utf8, en_CA.utf8, en_DK.utf8, en_GB.utf8, en_HK.utf8, en_IE.utf8, en_IN.utf8, en_NG.utf8, en_NZ.utf8, en_PH.utf8, en_SG.utf8, en_US.utf8, en_ZA.utf8, en_ZM.utf8, en_ZW.utf8

export LC_ALL=en_US.utf8

cmake .. \
    -D CMAKE_FIND_PACKAGE_PREFER_CONFIG=TRUE                                          \
    -D CMAKE_PREFIX_PATH="$HOME/.mussels/install/host-static"                         \
    -D CMAKE_INSTALL_PREFIX="/usr/local"                                              \
    -D CPACK_PACKAGING_INSTALL_PREFIX="/usr/local"                                    \
    -D CPACK_DEBIAN_PACKAGE_RELEASE=1                                                 \
    -D CPACK_RPM_PACKAGE_RELEASE=1                                                    \
    -D CMAKE_MODULE_PATH="$HOME/.mussels/install/host-static/lib/cmake"               \
    -D CMAKE_BUILD_TYPE=RelWithDebInfo                                                \
    -D ENABLE_EXAMPLES=OFF                                                            \
    -D ENABLE_MILTER=OFF                                                              \
    -D JSONC_INCLUDE_DIR="$HOME/.mussels/install/host-static/include/json-c"          \
    -D JSONC_LIBRARY="$HOME/.mussels/install/host-static/lib/libjson-c.a"             \
    -D ENABLE_JSON_SHARED=OFF                                                         \
    -D BZIP2_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                 \
    -D BZIP2_LIBRARY_RELEASE="$HOME/.mussels/install/host-static/lib/libbz2_static.a" \
    -D OPENSSL_ROOT_DIR="$HOME/.mussels/install/host-static"                          \
    -D OPENSSL_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"               \
    -D OPENSSL_CRYPTO_LIBRARY="$HOME/.mussels/install/host-static/lib/libcrypto.a"    \
    -D OPENSSL_SSL_LIBRARY="$HOME/.mussels/install/host-static/lib/libssl.a"          \
    -D LIBXML2_INCLUDE_DIR="$HOME/.mussels/install/host-static/include/libxml2"       \
    -D LIBXML2_LIBRARY="$HOME/.mussels/install/host-static/lib/libxml2.a"             \
    -D PCRE2_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                 \
    -D PCRE2_LIBRARY="$HOME/.mussels/install/host-static/lib/libpcre2-8.a"            \
    -D NCURSES_INCLUDE_DIR="$HOME/.mussels/install/host-static/include/ncurses"       \
    -D CURSES_LIBRARY="$HOME/.mussels/install/host-static/lib/libncurses.a"           \
    -D ZLIB_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                  \
    -D ZLIB_LIBRARY="$HOME/.mussels/install/host-static/lib/libz.a"                   \
    -D LIBCHECK_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"              \
    -D LIBCHECK_LIBRARY="$HOME/.mussels/install/host-static/lib/libcheck.a"

make -j12

ctest -V

cpack -G RPM

cpack -G DEB

python3 -m pip install --user mussels

# This requires Git, and will clone the the "clamav" and "scrapbook" cookbooks.
msl up

# This is to enable running the scripts in the clamav cookbook to build the clamav dependencies.
msl cookbook trust -y clamav

# This is just to get you in a small directory so Mussels don't spend forever searching your harddrive for build recipes.
mkdir tmp && cd tmp

# First try a dry-run. If you're missing any tools, it will tell you.
# If you have everything, it will give you a list of the order it plans to build everything.
msl build -t host-static clamav_deps --dry-run

# Then do the build.
msl build -t host-static clamav_deps

cmake .. \
    -G Xcode                                                                            \
    -D CLAMAV_SIGN_FILE=ON                                                              \
    -D CMAKE_OSX_ARCHITECTURES="arm64;x86_64"                                           \
    -D CMAKE_FIND_PACKAGE_PREFER_CONFIG=TRUE                                            \
    -D CMAKE_PREFIX_PATH="$HOME/.mussels/install/host-static"                           \
    -D CMAKE_INSTALL_PREFIX="/usr/local/clamav"                                         \
    -D CPACK_PACKAGING_INSTALL_PREFIX="/usr/local"                                      \
    -D CMAKE_MODULE_PATH="$HOME/.mussels/install/host-static/lib/cmake"                 \
    -D ENABLE_EXAMPLES=OFF                                                              \
    -D JSONC_INCLUDE_DIR="$HOME/.mussels/install/host-static/include/json-c"            \
    -D JSONC_LIBRARY="$HOME/.mussels/install/host-static/lib/libjson-c.a"               \
    -D ENABLE_JSON_SHARED=OFF                                                           \
    -D BZIP2_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                   \
    -D BZIP2_LIBRARY_RELEASE="$HOME/.mussels/install/host-static/lib/libbz2_static.a"   \
    -D OPENSSL_ROOT_DIR="$HOME/.mussels/install/host-static"                            \
    -D OPENSSL_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                 \
    -D OPENSSL_CRYPTO_LIBRARY="$HOME/.mussels/install/host-static/lib/libcrypto.a"      \
    -D OPENSSL_SSL_LIBRARY="$HOME/.mussels/install/host-static/lib/libssl.a"            \
    -D LIBXML2_INCLUDE_DIR="$HOME/.mussels/install/host-static/include/libxml2"         \
    -D LIBXML2_LIBRARY="$HOME/.mussels/install/host-static/lib/libxml2.a"               \
    -D PCRE2_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                   \
    -D PCRE2_LIBRARY="$HOME/.mussels/install/host-static/lib/libpcre2-8.a"              \
    -D CURSES_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                  \
    -D CURSES_LIBRARY="$HOME/.mussels/install/host-static/lib/libncurses.a"             \
    -D ZLIB_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                    \
    -D ZLIB_LIBRARY="$HOME/.mussels/install/host-static/lib/libz.a"                     \
    -D LIBCHECK_INCLUDE_DIR="$HOME/.mussels/install/host-static/include"                \
    -D LIBCHECK_LIBRARY="$HOME/.mussels/install/host-static/lib/libcheck.a"

cmake --build . --config RelWithDebInfo

ctest -C RelWithDebInfo -V

cpack -C RelWithDebInfo

python3 -m pip install --user mussels

# This requires Git, and will clone the the "clamav" and "scrapbook" cookbooks.
msl up

# This is to enable running the scripts in the clamav cookbook to build the clamav dependencies.
msl cookbook trust -y clamav

# This is just to get you in a small directory so Mussels don't spend forever searching your harddrive for build recipes.
mkdir tmp && cd tmp

# First try a dry-run. If you're missing any tools, it will tell you.
# If you have everything, it will give you a list of the order it plans to build everything.
msl build clamav_deps --dry-run

# Then do the build.
msl build clamav_deps

# By default, this build will be for x64*
# If you want to build for x86, run:
msl build -t x86 clamav_deps

pushd "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\Tools"
cmd /c "VsDevCmd.bat -arch=amd64 & set" |
foreach {
  if ($_ -match "=") {
    $v = $_.split("="); set-item -force -path "ENV:\$($v[0])"  -value "$($v[1])"
  }
}
popd
Write-Host "`nVisual Studio Command Prompt variables set." -ForegroundColor Yellow

cmake ..  -G Ninja -D CMAKE_BUILD_TYPE="RelWithDebInfo" `
    -D ENABLE_EXAMPLES=OFF                                                   `
    -D ENABLE_JSON_SHARED=OFF                                                `
    -D JSONC_INCLUDE_DIR="$home\.mussels\install\x64\include\json-c"         `
    -D JSONC_LIBRARY="$home\.mussels\install\x64\lib\json-c.lib"             `
    -D BZIP2_INCLUDE_DIR="$home\.mussels\install\x64\include"                `
    -D BZIP2_LIBRARY_RELEASE="$home\.mussels\install\x64\lib\libbz2.lib"     `
    -D CURL_INCLUDE_DIR="$home\.mussels\install\x64\include"                 `
    -D CURL_LIBRARY="$home\.mussels\install\x64\lib\libcurl_imp.lib"         `
    -D OPENSSL_ROOT_DIR="$home\.mussels\install\x64"                         `
    -D OPENSSL_INCLUDE_DIR="$home\.mussels\install\x64\include"              `
    -D OPENSSL_CRYPTO_LIBRARY="$home\.mussels\install\x64\lib\libcrypto.lib" `
    -D ZLIB_LIBRARY="$home\.mussels\install\x64\lib\libssl.lib"              `
    -D LIBXML2_INCLUDE_DIR="$home\.mussels\install\x64\include\libxml2"      `
    -D LIBXML2_LIBRARY="$home\.mussels\install\x64\lib\libxml2.lib"          `
    -D PCRE2_INCLUDE_DIR="$home\.mussels\install\x64\include"                `
    -D PCRE2_LIBRARY="$home\.mussels\install\x64\lib\pcre2-8.lib"            `
    -D CURSES_INCLUDE_DIR="$home\.mussels\install\x64\include"               `
    -D CURSES_LIBRARY="$home\.mussels\install\x64\lib\pdcurses.lib"          `
    -D PThreadW32_INCLUDE_DIR="$home\.mussels\install\x64\include"           `
    -D PThreadW32_LIBRARY="$home\.mussels\install\x64\lib\pthreadVC2.lib"    `
    -D ZLIB_INCLUDE_DIR="$home\.mussels\install\x64\include"                 `
    -D ZLIB_LIBRARY="$home\.mussels\install\x64\lib\zlibstatic.lib"          `
    -D LIBCHECK_INCLUDE_DIR="$home\.mussels\install\x64\include"             `
    -D LIBCHECK_LIBRARY="$home\.mussels\install\x64\lib\checkDynamic.lib"

ninja

ctest -C RelWithDebInfo -V

cpack -C RelWithDebInfo

gdb --args ./installed/bin/clamscan -d /tmp/test.ldb -d /tmp/block_list.crb -d --dumpcerts --debug --verbose --max-filesize=2000M --max-scansize=2000M --max-files=2000000 --max-recursion=2000000 --max-embeddedpe=2000M --max-iconspe=2000000 f8f101166fec5785b4e240e4b9e748fb6c14fdc3cd7815d74205fc59ce121515

valgrind --leak-check=full ./installed/bin/clamscan -d /tmp/test.ldb --leave-temps --tempdir /tmp/test --debug --verbose /tmp/upx-samples/ > /tmp/upx-results-2.txt 2>&1

MALLOC_CHECK_=7 ./installed/bin/clamscan

sudo apt-get install linux-tools-common linux-tools-generic linux-tools-`uname -r`

E: Unable to locate package linux-tools-4.19.104-microsoft-standard
E: Couldn't find any package by glob 'linux-tools-4.19.104-microsoft-standard'
E: Couldn't find any package by regex 'linux-tools-4.19.104-microsoft-standard'

sudo apt install flex bison
git clone https://github.com/microsoft/WSL2-Linux-Kernel --depth 1 --branch linux-msft-wsl-5.10.16.3
cd WSL2-Linux-Kernel/tools/perf
make -j8
sudo cp perf /usr/local/bin

sudo su     # Run the following as root
cat /proc/sys/kernel/perf_event_paranoid
echo "1" > /proc/sys/kernel/perf_event_paranoid
exit

perf record -F 100 -g -- ./install/bin/clamscan -d ./unit_tests/clamav.hdb --allmatch ./test/
perf script > /tmp/out.perf

git clone https://github.com/brendangregg/FlameGraph.git
cd FlameGraph

perl stackcollapse-perf.pl /tmp/out.perf > /tmp/out.folded
perl flamegraph.pl /tmp/out.folded > /tmp/test.svg

    % time     seconds  usecs/call     calls    errors syscall
    ------ ----------- ----------- --------- --------- ----------------
    95.04    0.831430          13     62518           read
    3.22    0.028172          14      2053           munmap
    0.69    0.006005           3      2102           mmap
    0.28    0.002420           7       344           pread64
    0.16    0.001415           5       305         1 openat
    0.13    0.001108           3       405           write
    0.11    0.000932          23        40           mprotect
    0.07    0.000632           2       310           close
    0.07    0.000583           9        67        30 access
    0.05    0.000395           1       444           lseek
    0.04    0.000344           2       162           fstat
    0.04    0.000338           1       253           brk
    0.03    0.000262           1       422           fcntl
    0.02    0.000218          16        14           futex
    0.01    0.000119           1       212           getpid
    0.01    0.000086          14         6           getdents
    0.00    0.000043           7         6           dup
    0.00    0.000040           1        31           unlink
    0.00    0.000038          19         2           rt_sigaction
    0.00    0.000037          19         2           rt_sigprocmask
    0.00    0.000029           1        37           stat
    0.00    0.000022          11         2           prlimit64
    0.00    0.000021          21         1           sysinfo
    0.00    0.000020           1        33           clock_gettime
    0.00    0.000019          19         1           arch_prctl
    0.00    0.000018          18         1           set_tid_address
    0.00    0.000018          18         1           set_robust_list
    0.00    0.000013           0        60           lstat
    0.00    0.000011           0        65           madvise
    0.00    0.000002           0        68           geteuid
    0.00    0.000000           0         1           execve
    0.00    0.000000           0         1           uname
    0.00    0.000000           0         1           getcwd
    ------ ----------- ----------- --------- --------- ----------------
    100.00    0.874790                 69970        31 total

    VIRUSNAME_PREFIX("BC.Heuristic.Test.Read.Passed")
    VIRUSNAMES("")
    TARGET(0)

    SIGNATURES_DECL_BEGIN
    DECLARE_SIGNATURE(zeroes)
    SIGNATURES_DECL_END

    SIGNATURES_DEF_BEGIN
    DEFINE_SIGNATURE(zeroes, "0:0000")
    SIGNATURES_DEF_END

    bool logical_trigger()
    {
        return matches(Signatures.zeroes);
    }

    #define READ_S(value, size) if (read(value, size) != size) return 0;

    int entrypoint(void)
    {
        char buffer[65536];
        int i;

        for (i = 0; i < 256; i++)
        {
            debug(i);
            debug("\n");
            READ_S(buffer, sizeof(buffer));
        }

        foundVirus("");
        return 0;
    }

clambc-compiler read_test.bc
dd if=/dev/zero of=/tmp/zeroes bs=65535 count=256
strace clamscan -d read_test.cbc --bytecode-unsigned /tmp/zeroes

strace -e fault=pread64:error=EINTR:when=20+10 clamscan -d read_test.cbc --bytecode-unsigned /tmp/zeroes

    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15007744) = 65536
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15073280) = 65536
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15138816) = 65536
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15204352) = 65536
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15269888) = 65536
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15335424) = 65536
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15400960) = 65536
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15466496) = 65536
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15532032) = 65536
    pread64(3, 0x7f6a7ff43000, 65536, 15597568) = -1 EINTR (Interrupted system call) (INJECTED)
    pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15597568) = 65536

lcov -z --directory . --output-file coverage.lcov.data

lcov -c --directory . --output-file coverage.lcov.data

genhtml coverage.lcov.data --output-directory report

python3 infra/helper.py build_image clamav
python3 infra/helper.py build_fuzzers --sanitizer address clamav ../clamav
python3 infra/helper.py reproduce clamav clamav_scanmap_fuzzer /path/to/poc_file

mkdir build-fuzz && cd build-fuzz

export CC=`which clang` && \
    export CXX=`which clang++` && \
    export SANITIZER=address && \
    cmake .. -G Ninja \
        -D OPTIMIZE=OFF \
        -D CMAKE_BUILD_TYPE="Debug" \
        -D ENABLE_FUZZ=ON \
    && \
    ninja

./fuzz/clamav_scanfile_fuzzer /path/to/poc_file

CFLAGS="-ggdb -O0 -fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address" CXXFLAGS="-ggdb -O0 -fsanitize=address -fno-omit-frame-pointer" OBJCFLAGS="-ggdb -O0 -fsanitize=address -fno-omit-frame-pointer" ../configure --prefix=`pwd`/../installed --enable-debug --enable-libjson --with-systemdsystemunitdir=no --enable-experimental --enable-clamdtop --enable-libjson --enable-xml --enable-pcre --disable-llvm

    #include "clamav.h"

    int cl_init(unsigned int options);
    struct cl_engine *cl_engine_new(void);
    int cl_engine_free(struct cl_engine *engine);

    const char *cl_retdbdir(void);

    int cl_load(const char *path, struct cl_engine *engine,
            unsigned int *signo, unsigned int options);

        ...
        struct cl_engine *engine;
        unsigned int sigs = 0;
        int ret;

    if((ret = cl_init(CL_INIT_DEFAULT)) != CL_SUCCESS) {
        printf("cl_init() error: %s\n", cl_strerror(ret));
        return 1;
    }

    if(!(engine = cl_engine_new())) {
        printf("Can't create new engine\n");
        return 1;
    }

    ret = cl_load(cl_retdbdir(), engine, &sigs, CL_DB_STDOPT);

/**
 * @brief Verify a CVD file by loading and unloading it.
 *
 * @param file          Filepath of CVD file.
 * @return cl_error_t   CL_SUCCESS if success, else a CL_E* error code.
 */
extern cl_error_t cl_cvdverify(const char *file);

    if(ret != CL_SUCCESS) {
        printf("cl_load() error: %s\n", cl_strerror(ret));
        cl_engine_free(engine);
        return 1;
    }

    int cl_engine_compile(struct cl_engine *engine);

    if((ret = cl_engine_compile(engine)) != CL_SUCCESS) {
        printf("cl_engine_compile() error: %s\n", cl_strerror(ret));
        cl_engine_free(engine);
        return 1;
    }

    int cl_engine_set_num(struct cl_engine *engine,
    enum cl_engine_field field, long long num);

    long long cl_engine_get_num(const struct cl_engine *engine,
    enum cl_engine_field field, int *err);

    int cl_engine_set_str(struct cl_engine *engine,
    enum cl_engine_field field, const char *str);

    const char *cl_engine_get_str(const struct cl_engine *engine,
    enum cl_engine_field field, int *err);

    int cl_statinidir(const char *dirname, struct cl_stat *dbstat);
    int cl_statchkdir(const struct cl_stat *dbstat);
    int cl_statfree(struct cl_stat *dbstat);

        ...
        struct cl_stat dbstat;

    memset(&dbstat, 0, sizeof(struct cl_stat));
    cl_statinidir(dbdir, &dbstat);

    if(cl_statchkdir(&dbstat) == 1) {
        reload_database...;
        cl_statfree(&dbstat);
        cl_statinidir(cl_retdbdir(), &dbstat);
    }

    int cl_countsigs(const char *path, unsigned int countoptions,
        unsigned int *sigs);

    int cl_scanfile(
        const char *filename,
        const char **virname,
        unsigned long int *scanned,
        const struct cl_engine *engine,
        struct cl_scan_options *options);

    int cl_scandesc(
        int desc,
        const char *filename,
        const char **virname,
        unsigned long int *scanned,
        const struct cl_engine *engine,
        struct cl_scan_options *options);

    struct cl_scan_options {
        uint32_t general;
        uint32_t parse;
        uint32_t alert;
        uint32_t heuristic_alert;
        uint32_t mail;
        uint32_t dev;
    };

        ...
        const char *virname;

    if((ret = cl_scanfile("/tmp/test.exe", &virname, NULL, engine,
    &options)) == CL_VIRUS) {
        printf("Virus detected: %s\n", virname);
    } else {
        printf("No virus detected.\n");
        if(ret != CL_CLEAN)
            printf("Error: %s\n", cl_strerror(ret));
    }

    $ clamav-config --libs
    -L/usr/local/lib -lz -lbz2 -lgmp -lpthread

    $ clamav-config --cflags
    -I/usr/local/include -g -O2

gcc -Wall ex1.c -o ex1 -lclamav

    ClamAV-VDB:build time:version:number of signatures:functionality
    level required:MD5 checksum:digital signature:builder name:build time (sec)

    $ sigtool -i daily.cvd
    File: daily.cvd
    Build time: 10 Mar 2008 10:45 +0000
    Version: 6191
    Signatures: 59084
    Functionality level: 26
    Builder: ccordes
    MD5: 6e6e29dae36b4b7315932c921e568330
    Digital signature: zz9irc9irupR3z7yX6J+OR6XdFPUat4HIM9ERn3kAcOWpcMFxq
    Fs4toG5WJsHda0Jj92IUusZ7wAgYjpai1Nr+jFfXHsJxv0dBkS5/XWMntj0T1ctNgqmiF
    +RLU6V0VeTl4Oej3Aya0cVpd9K4XXevEO2eTTvzWNCAq0ZzWNdjc
    Verification OK.

0:0:4C0000000114020000000000C000000000000046:Microsoft Windows Shortcut File:CL_TYPE_ANY:CL_TYPE_LNK:100

SignatureName;Target:0;(0&1);0:4C0000000114020000000000C000000000000046;deadbeef

SignatureName;Target:0,FileTypes:CL_TYPE_LNK;(0);deadbeef

ERROR: Failed to get information about user "clamav".
Create the "clamav" user account for freshclam to use, or set the DatabaseOwner config option in freshclam.conf to a different user.
For more information, see https://docs.clamav.net/manual/Installing/Installing-from-source-Unix.html
ERROR: Initialization error!

ERROR: Can't create freshclam.dat in /usr/local/share/clamav
Hint: The database directory must be writable for UID 1000 or GID 1000
ERROR: Failed to save freshclam.dat!
WARNING: Failed to create a new freshclam.dat!
ERROR: initialize: libfreshclam init failed.
ERROR: Initialization error!

sudo chown -R bob /usr/local/share/clamav

sudo chown -R clamav /usr/local/share/clamav

WARNING: Download failed (77) WARNING:  Message: Problem with the SSL CA cert (path? access rights?
WARNING: Can't download daily.cvd from https://database.clamav.net/daily.cvd

CURL_CA_BUNDLE=/var/lib/ca-certificates/ca-bundle.pem freshclam

DatabaseMirror machine1.mylan

ScriptedUpdates off

DNSDatabaseInfo current.cvd.clamav.net

DatabaseMirror database.clamav.net

host -t txt current.cvd.clamav.net

host -t txt current.cvd.clamav.net; perl -e 'printf "%d\n", time;'

host database.clamav.net

dig @ns1.clamav.net db.us.big.clamav.net

$ host -t txt current.cvd.clamav.net

clamav-0.104.1/build/unit_tests/input/clamav_hdb_scanfiles/clam.chm: Clamav.Test.File-6 FOUND

user@laptop:~$  mkdir /tmp/sigdump

user@laptop:~$  cd /tmp/sigdump

user@laptop:/tmp/sigdump$  sigtool -u /usr/local/share/clamav/main.cvd

user@laptop:/tmp/sigdump$  sigtool -u /usr/local/share/clamav/daily.cvd        # May be: daily.cld

user@laptop:/tmp/sigdump$  sigtool -u /usr/local/share/clamav/bytecode.cvd     # May be: bytecode.cld

user@laptop:/tmp/sigdump$  ls

3986187.cbc    3986230.cbc    3986303.cbc    4553522.cbc    6335443.cbc    6399052.cbc    daily.cfg      daily.msb
3986188.cbc    3986231.cbc    3986305.cbc    4970075.cbc    6335540.cbc    6404655.cbc    daily.crb      daily.msu
3986206.cbc    3986232.cbc    3986306.cbc    5044126.cbc    6335560.cbc    6428210.cbc    daily.fp       daily.ndb
3986212.cbc    3986233.cbc    3986310.cbc    5588995.cbc    6335564.cbc    6428556.cbc    daily.ftm      daily.ndu
3986214.cbc    3986234.cbc    3986321.cbc    5819336.cbc    6335669.cbc    6441308.cbc    daily.hdb      daily.pdb
3986215.cbc    3986235.cbc    3986322.cbc    5999914.cbc    6336023.cbc    6442366.cbc    daily.hdu      daily.sfp
3986216.cbc    3986236.cbc    3986327.cbc    5999936.cbc    6336035.cbc    6447941.cbc    daily.hsb      daily.wdb
3986217.cbc    3986242.cbc    3986328.cbc    6300337.cbc    6336074.cbc    6453673.cbc    daily.hsu      main.crb
3986218.cbc    3986244.cbc    3986334.cbc    6311970.cbc    6336259.cbc    6471051.cbc    daily.idb      main.fp
3986219.cbc    3986249.cbc    3986337.cbc    6316126.cbc    6336260.cbc    6497366.cbc    daily.ign      main.hdb
3986220.cbc    3986259.cbc    4306126.cbc    6324281.cbc    6336630.cbc    6539706.cbc    daily.ign2     main.hsb
3986221.cbc    3986282.cbc    4306157.cbc    6327695.cbc    6336737.cbc    6566834.cbc    daily.info     main.info
3986222.cbc    3986283.cbc    4307467.cbc    6329916.cbc    6336739.cbc    6614848.cbc    daily.ldb      main.mdb
3986223.cbc    3986289.cbc    4416867.cbc    6329917.cbc    6364361.cbc    COPYING        daily.ldu      main.msb
3986224.cbc    3986292.cbc    4510302.cbc    6335400.cbc    6380163.cbc    bytecode.info  daily.mdb      main.ndb
3986229.cbc    3986301.cbc    4526683.cbc    6335427.cbc    6395243.cbc    daily.cdb      daily.mdu      main.sfp

user@laptop:/tmp/sigdump$  grep -r Win.Downloader.DDECmdExec-6683887-5

Win.Downloader.DDECmdExec-6683887-5;Engine:81-255,Target:0;4;0:1f8b;0:255044462d;0:4d5a{-100}50450000;7c27{-255}2721;(0=0&1=0&2=0)&3/(?<!\x20)[=+\-@]\s*?(\w+\s*?\x28)?.{0,50}(certutil|cmd|cmstp|cscript|dnscmd|msiexec|netsh|regsvr32|rpcping|rundll32|schtasks|telnet|tscon|tsdiscon|wmic|wscript).{0,50}\|\s*?\x27[^\x27]{5,255}\x27\s*?\x21/i

user@laptop:/tmp/sigdump$  grep Win.Downloader.DDECmdExec-6683887-5 -r . | ../../bin/sigtool --decode-sigs

    VIRUS NAME: ./daily.ldb:Win.Downloader.DDECmdExec-6683887-5
    TDB: Engine:81-255,Target:0
    LOGICAL EXPRESSION: 4
     * SUBSIG ID 0
     +-> OFFSET: 0
     +-> SIGMOD: NONE
     +-> DECODED SUBSIGNATURE:
    �
     * SUBSIG ID 1
     +-> OFFSET: 0
     +-> SIGMOD: NONE
     +-> DECODED SUBSIGNATURE:
    %PDF-
     * SUBSIG ID 2
     +-> OFFSET: 0
     +-> SIGMOD: NONE
     +-> DECODED SUBSIGNATURE:
    MZ{WILDCARD_ANY_STRING(LENGTH<=100)}PE
     * SUBSIG ID 3
     +-> OFFSET: ANY
     +-> SIGMOD: NONE
     +-> DECODED SUBSIGNATURE:
    |'{WILDCARD_ANY_STRING(LENGTH<=255)}'!
     * SUBSIG ID 4
     +-> OFFSET: ANY
     +-> SIGMOD: NONE
     +-> DECODED SUBSIGNATURE:
         +-> TRIGGER: (0=0&1=0&2=0)&3
         +-> REGEX: (?<!\x20)[=+\-@]\s*?(\w+\s*?\x28)?.{0,50}(certutil|cmd|cmstp|cscript|dnscmd|msiexec|netsh|regsvr32|rpcping|rundll32|schtasks|telnet|tscon|`tsdiscon|wmic|wscript).{0,50}\|\s*?\x27[^\x27]{5,255}\x27\s*?\x21
         +-> CFLAGS: i

yum list clamav

yum update clamav

whereis freshclam

whereis clamscan

ldd $(which freshclam)

gpg --import cisco-talos.gpg

gpg --verify clamav-X.XX.tar.gz.sig

    gpg: Signature made Wed Jan 24 19:31:26 2018 EST
    gpg:                using RSA key F13F9E16BCA5BFAD
    gpg: Good signature from "Talos (Talos, Cisco Systems Inc.) [email address]" [unknown]

  DetectPUA yes        # Detect Possibly Unwanted Applications
  ExcludePUA CAT       # Skip PUA sigs of category CAT
  IncludePUA CAT       # Load PUA sigs of category CAT

  --detect-pua         # Detect Possibly Unwanted Applications
  --exclude-pua=CAT    # Skip PUA sigs of category CAT
  --include-pua=CAT    # Load PUA sigs of category CAT

  PUA.category.subcategory.description-version

PUA.Andr.Adware
PUA.Andr.Downloader
PUA.Andr.Dropper
PUA.Andr.Tool
PUA.Andr.Trojan
PUA.Andr.Virus
PUA.Cert.Revoked
PUA.Doc.Dropper
PUA.Doc.Packed
PUA.Doc.Tool
PUA.Doc.Trojan
PUA.Email.Phishing
PUA.Email.Trojan
PUA.Embedded.File
PUA.Html.Exploit
PUA.Html.Tool
PUA.Html.Trojan
PUA.Java.Exploit
PUA.Java.Packer
PUA.Js.Exploit
PUA.Osx.File
PUA.Osx.Trojan
PUA.Packed.Tool
PUA.Pdf.Exploit
PUA.Pdf.Trojan
PUA.Php.Trojan
PUA.Rtf.Exploit
PUA.Spy.Tool
PUA.Swf.Spyware
PUA.Tool.Countermeasure
PUA.Tool.Tool
PUA.Unix.Adware
PUA.Unix.Coinminer
PUA.Unix.Downloader
PUA.Unix.File
PUA.Unix.Malware
PUA.Unix.Tool
PUA.Unix.Trojan
PUA.Unix.Virus
PUA.Win.Adware
PUA.Win.Coinminer
PUA.Win.Downloader
PUA.Win.Dropper
PUA.Win.Exploit
PUA.Win.File
PUA.Win.Ircbot
PUA.Win.Joke
PUA.Win.Keylogger
PUA.Win.Malware
PUA.Win.Packed
PUA.Win.Packer
PUA.Win.Proxy
PUA.Win.Ransomware
PUA.Win.Spyware
PUA.Win.Tool
PUA.Win.Trojan
PUA.Win.Virus

sudo make uninstall

./configure
sudo make uninstall

xargs rm < install_manifest.txt

cmake . &&
make && sudo make install
sudo xargs rm < install_manifest.txt

ldd `which freshclam`

whereis freshclam

whereis clamscan

pip3 install cvdupdate

cvd config set --dbdir <your www path>

cvd update

# Replace `mirror.mylan` and `8000` with your domain and port number.
DatabaseMirror http://mirror.mylan:8000

DatabaseMirror https://mirror.mylan

DatabaseMirror http://mirror.mylan:8000/clamav

# The private mirror will update from database.clamav.net.
DatabaseMirror database.clamav.net

# Customize the DatabaseDirectory so that FreshClam will update the DocumentRoot.
DatabaseDirectory /your/server/www

# Enable CLD compression to save bandwidth between your mirror and your clients.
CompressLocalDatabase yes

# PrivateMirror is used instead of DatabaseMirror so that FreshClam will:
# 1. Accept CVD or CLD files, not just CVD files.
# 2. Use an HTTP Range-request to check if there is an update, rather than DNS.
PrivateMirror http://mirror.mylan:8000

# ScriptedUpdates is not needed because you won't be serving CDIFF files.
ScriptedUpdates no

    $ osslsigncode verify /path/to/signed/file
    Current PE checksum   : 00092934
    Calculated PE checksum: 00092934

    Message digest algorithm  : SHA256
    Current message digest    : 56924EB391B1B04572B1841ED5D5C10927CE7D6E9553A69F994B9BA855A73933
    Calculated message digest : 56924EB391B1B04572B1841ED5D5C10927CE7D6E9553A69F994B9BA855A73933

    Signature verification: ok

    Number of signers: 1
        Signer #0:
            Subject: /C=US/ST=California/L=Mountain View/O=Google Inc/CN=Google Inc
            Issuer : /C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 SHA256 Code Signing CA

    Number of certificates: 2
        Cert #0:
            Subject: /C=US/ST=California/L=Mountain View/O=Google Inc/CN=Google Inc
            Issuer : /C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 SHA256 Code Signing CA
        Cert #1:
            Subject: /C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 SHA256 Code Signing CA
            Issuer : /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5

    Succeeded

dd if=/path/to/extracted of=/path/to/extracted.p7b bs=1 skip=8`

    $ openssl pkcs7 -inform der -print_certs -in extracted.p7b -noout -text
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number:
                2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
        Signature Algorithm: sha256WithRSAEncryption
            Issuer: C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA
            Validity
                Not Before: Dec 16 00:00:00 2015 GMT
                Not After : Dec 16 23:59:59 2018 GMT
            Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=Google Inc
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (2048 bit)
                    Modulus:
                        00:c4:0d:82:c4:41:29:28:e5:fd:0c:3f:a5:c7:0e:
                        66:bd:a5:c4:8b:b3:8a:ac:84:03:9f:84:2e:38:df:
                        06:b1:4e:fd:33:60:58:38:36:dd:22:cf:df:f1:50:
                        1f:47:f1:55:05:c1:81:01:e7:28:3e:ff:5f:89:12:
                        09:ea:df:aa:17:49:2c:71:ab:48:d1:9d:2e:f4:51:
                        e0:03:e0:f7:16:6c:7b:0c:22:75:6d:7e:1f:49:c4:
                        43:28:88:41:dc:6c:ed:13:2a:03:99:eb:62:14:f9:
                        35:26:6e:12:2c:03:e2:f7:81:b9:1a:05:67:06:7c:
                        a6:1a:5b:ed:20:15:e5:2d:83:de:8e:36:fa:1e:08:
                        41:1c:1a:48:9f:b6:f1:c3:2f:02:13:4b:a7:ca:ba:
                        ef:1c:58:6f:8e:d3:0f:14:a4:0b:2b:5d:ba:f4:5a:
                        a3:0d:64:34:a5:8a:d7:8f:4d:22:66:4d:a4:ae:e1:
                        f9:cd:c6:58:e6:c6:11:77:32:df:ba:df:39:48:8a:
                        d1:27:d7:33:77:a8:c9:e4:5e:ed:fa:12:cf:f3:fd:
                        fa:ee:ab:80:86:13:34:eb:5a:7e:6f:6c:1b:ee:d8:
                        4b:b2:cc:77:98:87:ac:ca:f5:bb:64:6f:49:1e:5b:
                        91:63:50:1f:63:2d:83:27:73:07:9f:2b:16:f4:7b:
                        71:29
                    Exponent: 65537 (0x10001)
            X509v3 extensions:
                X509v3 Basic Constraints:
                    CA:FALSE
                X509v3 Key Usage: critical
                    Digital Signature
                X509v3 Extended Key Usage:
                    Code Signing
                X509v3 Certificate Policies:
                    Policy: 2.16.840.1.113733.1.7.23.3
                    CPS: https://d.symcb.com/cps
                    User Notice:
                        Explicit Text: https://d.symcb.com/rpa

                X509v3 Authority Key Identifier:
                    keyid:96:3B:53:F0:79:33:97:AF:7D:83:EF:2E:2B:CC:CA:B7:86:1E:72:66

                X509v3 CRL Distribution Points:

                    Full Name:
                    URI:http://sv.symcb.com/sv.crl

                Authority Information Access:
                    OCSP - URI:http://sv.symcd.com
                    CA Issuers - URI:http://sv.symcb.com/sv.crt

                Netscape Cert Type:
                    Object Signing
                1.3.6.1.4.1.311.2.1.27:
                    0.......
        Signature Algorithm: sha256WithRSAEncryption
            23:e7:93:93:af:db:a8:4d:af:af:54:e8:d8:26:95:80:cd:23:
            91:70:ed:0b:5b:b1:e9:d8:dd:1e:40:37:78:97:18:ed:9f:e5:
            84:67:85:06:50:b5:f1:ab:e6:83:5a:17:7b:51:be:7f:18:c6:
            47:5e:2b:aa:f4:a0:1f:35:3e:05:9f:43:40:f7:9f:d1:f4:e1:
            a7:02:f3:8e:c9:71:fe:18:37:48:42:d7:e4:36:73:10:92:d4:
            d8:d9:1c:c4:26:58:18:67:b6:24:22:69:63:02:f7:49:51:6b:
            75:f6:b4:7d:56:ff:2c:f4:88:f7:67:6f:08:86:f3:8b:0b:30:
            02:7f:6d:92:d9:4e:bd:99:f7:7b:74:86:0c:cb:b9:ad:2c:bf:
            44:79:a8:00:82:9c:62:f4:aa:11:df:d2:bf:f0:e1:92:28:11:
            90:bb:5e:33:88:86:96:4d:dd:0b:af:c3:67:a1:95:2d:44:32:
            c6:fa:f7:b8:80:c1:4e:38:be:1f:b6:84:f7:f1:21:31:67:49:
            a8:9f:8a:75:07:df:3b:3a:c3:ea:72:cd:40:7f:a7:da:7c:c9:
            2e:7c:a9:0c:f1:5d:5c:82:42:62:b9:49:94:8f:70:e6:a5:c0:
            5f:17:fb:40:36:c1:3a:89:63:03:1c:3f:66:a0:3d:8f:a1:4c:
            4e:5c:ac:bf
    ...

    $ openssl asn1parse -inform der -i -in extracted.p7b
        0:d=0  hl=4 l=6984 cons: SEQUENCE
        4:d=1  hl=2 l=   9 prim:  OBJECT            :pkcs7-signedData
    15:d=1  hl=4 l=6969 cons:  cont [ 0 ]
    19:d=2  hl=4 l=6965 cons:   SEQUENCE
    23:d=3  hl=2 l=   1 prim:    INTEGER           :01
    26:d=3  hl=2 l=  15 cons:    SET
    28:d=4  hl=2 l=  13 cons:     SEQUENCE
    30:d=5  hl=2 l=   9 prim:      OBJECT            :sha256
    41:d=5  hl=2 l=   0 prim:      NULL
    43:d=3  hl=2 l=  92 cons:    SEQUENCE
    45:d=4  hl=2 l=  10 prim:     OBJECT            :1.3.6.1.4.1.311.2.1.4
    57:d=4  hl=2 l=  78 cons:     cont [ 0 ]
    59:d=5  hl=2 l=  76 cons:      SEQUENCE
    61:d=6  hl=2 l=  23 cons:       SEQUENCE
    63:d=7  hl=2 l=  10 prim:        OBJECT            :1.3.6.1.4.1.311.2.1.15
    75:d=7  hl=2 l=   9 cons:        SEQUENCE
    77:d=8  hl=2 l=   1 prim:         BIT STRING
    80:d=8  hl=2 l=   4 cons:         cont [ 0 ]
    82:d=9  hl=2 l=   2 cons:          cont [ 2 ]
    84:d=10 hl=2 l=   0 prim:           cont [ 0 ]
    86:d=6  hl=2 l=  49 cons:       SEQUENCE
    88:d=7  hl=2 l=  13 cons:        SEQUENCE
    90:d=8  hl=2 l=   9 prim:         OBJECT            :sha256
    101:d=8  hl=2 l=   0 prim:         NULL
    103:d=7  hl=2 l=  32 prim:        OCTET STRING      [HEX DUMP]:56924EB391B1B04572B1841ED5D5C10927CE7D6E9553A69F994B9BA855A73933
    ...

    C:\>certutil -asn extracted.p7b
    0000: 30 82 1b 48                               ; SEQUENCE (1b48 Bytes)
    0004: |  06 09                                  ; OBJECT_ID (9 Bytes)
    0006: |  |  2a 86 48 86 f7 0d 01 07  02
        |  |     ; 1.2.840.113549.1.7.2 PKCS 7 Signed
    000f: |  a0 82 1b 39                            ; OPTIONAL[0] (1b39 Bytes)
    0013: |     30 82 1b 35                         ; SEQUENCE (1b35 Bytes)
    0017: |        02 01                            ; INTEGER (1 Bytes)
    0019: |        |  01
    001a: |        31 0f                            ; SET (f Bytes)
    001c: |        |  30 0d                         ; SEQUENCE (d Bytes)
    001e: |        |     06 09                      ; OBJECT_ID (9 Bytes)
    0020: |        |     |  60 86 48 01 65 03 04 02  01
        |        |     |     ; 2.16.840.1.101.3.4.2.1 sha256 (sha256NoSign)
    0029: |        |     05 00                      ; NULL (0 Bytes)
    002b: |        30 5c                            ; SEQUENCE (5c Bytes)
    002d: |        |  06 0a                         ; OBJECT_ID (a Bytes)
    002f: |        |  |  2b 06 01 04 01 82 37 02  01 04
        |        |  |     ; 1.3.6.1.4.1.311.2.1.4 SPC_INDIRECT_DATA_OBJID
    0039: |        |  a0 4e                         ; OPTIONAL[0] (4e Bytes)
    003b: |        |     30 4c                      ; SEQUENCE (4c Bytes)
    003d: |        |        30 17                   ; SEQUENCE (17 Bytes)
    003f: |        |        |  06 0a                ; OBJECT_ID (a Bytes)
    0041: |        |        |  |  2b 06 01 04 01 82 37 02  01 0f
        |        |        |  |     ; 1.3.6.1.4.1.311.2.1.15 SPC_PE_IMAGE_DATA_OBJID
    004b: |        |        |  30 09                ; SEQUENCE (9 Bytes)
    ...

Feature release	First Published	Latest patch version	Expected End of Life (EOL)	Signature load testing until	Signature FP testing until	DB downloads allowed until	Patch versions continue until
1.4	TBD	n/a	1.6 + 4 months	1.6 + 4 months	1.5 published	1.6 + 4 months	1.5 + 4 months, or 1.6
1.3	Feb-7 2024	1.3.0	1.5 + 4 months	1.5 + 4 months	1.4 published	1.5 + 4 months	1.4 + 4 months, or 1.5
1.2	Aug-28 2023	1.2.2	1.4 + 4 months	1.4 + 4 months	Feb-7 2024 (1.3 published)	1.4 + 4 months	Jun-7 2024 or earlier (1.3 + 4 months, or 1.4)
1.1	May-1 2023	1.1.3	Jun-7 2024 (1.3 + 4 months)	Jun-7 2024 (1.3 + 4 months)	Aug-28 2023 (1.2 published)	Jun-7 2024 (1.3 + 4 months)	Dec-28 2023 (1.2 + 4 months, or 1.3)
1.0 LTS	Nov-28 2022	1.0.5	Nov-28 2025 (3 years)	Nov-28 2025 (3 years)	May-1 2023 (1.1 published)	Nov-28 2026 (3 years)	Nov-28 2025 (3 years)
0.105	May-4 2022	0.105.2	Sep-1 2023 (1.1 + 4 months)	Sep-1 2023 (1.1 + 4 months)	Nov-28 2022 (1.0 published)	Sep-1 2023 (1.1 + 4 months)	Mar-28 2023 (1.0 + 4 months, or 1.1)
0.104	Sep-3 2021	0.104.4	Mar-28 2023 (1.0 + 4 months)	Mar-28 2023 (1.0 + 4 months)	May-4 2022 (0.105 published)	Mar-28 2023 (1.0 + 4 months)	Sep-4 2022 (0.105 + 4 months, or 1.0)
0.103 LTS	Sep-14 2020	0.103.8	Sep-14 2024 (3 years +1)	Sep-14 2024 (3 years +1)	Sep-3 2021 (0.104 published)	Sep-14 2025 (3 years +1)	Sep-14 2024 (3 years +1)
0.102	Oct-2 2019	0.102.5	Jan-3 2022 (0.104 + 4 mo.)	Jan-3 2022		Jan-3 2022
0.101	Dec-3 2018	0.101.5	Jan-3 2022	Jan-3 2022		Jan-3 2022
0.100	Apr-9 2018	0.100.3	Oct-29 2021	Oct-29 2021		Oct-29 2021
0.99	Dec-1 2015	0.99.4	Mar-1 2021

Term	Description
adware	Adware is software that injects extra advertisements into other applications like your browser, or extra advertisements bundled by a third party into software that is ordinarily free of advertisements. Adware is often considered to be a type of Potentially Unwanted Application (PUA) when the the advertisements aren't used to fund development of the application but are injected by a third party.
bytecode	Bytecode is a partially compiled executable that is platform agnostic but must be further compiled or otherwise interpreted in order to be executed. For ClamAV, "bytecode signature" refer to ClamAV plugin with a `.cbc` file extension. Some bytecode signatures detect specific types of malware, as the name suggests. Other bytecode signatures extend file parser support within ClamAV, enabling faster deployment of new ClamAV features.
CLD	A CLD is the uncompressed ClamAV signature database archive. CLD files are created by FreshClam when a CVD or CLD database archive is updated with a CDIFF patch file.
CVD	A CVD is an compressed ClamAV signature database archive that is signed and distributed by Cisco-Talos. "CVD" refers to the `.cvd` file extension, although when updated using a CDIFF database patch file, the extension is changed to `.cld`.
CDIFF	A CDIFF is a patch file for a CVD or CLD database archive. CDIFFs allow for frequent updates to the ClamAV database set without requiring a large download each time.
endpoint	An endpoint is a computer that a human interacts with, such as a laptop, desktop, or mobile device.
endpoint security suite	An endpoint security suite is software that bundles a variety of services to protect a computer system. In addition to scheduled malware scanning, this may include features like a firewall, on-access scanning, network traffic monitoring, process behavioral monitoring, and other real time protection features.
false negative	A false negative is when a scan fails to alert on a file. You can report false negatives on clamav.net.
false positive	A false positive is when a scan incorrectly alerts on a file. You can report false positive detections on clamav.net.
malware	Malware is a general term for software intended to cause harm, disrupt, or gain unauthorized access to a computer system. Trojans, worms, miners, rootkits, viruses, keyloggers, and ransomware are all examples of different types of malware.
on-access	On-access in the context of malware detection refers to a technology to scan files when they are created, opened, moved, or otherwise accessed. On-access scanning is one form of "real time protection". The scan may block access to the file and prevent access if an alert occurs, or it may simply scan as the file is being accessed to alert or take some action when the scan is complete.
PUA	A Potentially Unwanted Application (PUA) or Potentially Unwanted Program (PUP) is a program that probably isn't malware, but little benefit to the user and is considered to be undesirable by most people. This may include software like crypto currency mining software, adware, and other software that may be legitimate but may also be used to take advantage of unsuspecting users. See our FAQ page about PUA signatures for more information.

Component	Description
`clamav-config`	This is a script for checking how ClamAV was compiled. `clamav-config` is not present on Windows installations.
`clamav-milter`	ClamAV-Milter is a daemon that performs email filter scanning through `clamd`.
`clambc-compiler`	The ClamAV Bytecode Compiler (ClamBC-Compiler or ClamBCC) is a compiler for building bytecode executable signature plugins. The Bytecode Compiler installed separately. See the ClamAV Bytecode Compiler project on Github for more details.
`clambc`	ClamBC is another signature manipulation tool specifically for bytecode signatures.
`clamconf`	ClamConf is a tool to check or generate ClamAV configuration files and collect additional information that may be needed to help remotely debug issues.
`clamd`	ClamD is a multi threaded daemon that listens for scan requests on a network socket or unix socket. Client applications for `clamd` include `clamdtop`, `clamdscan`, `clamav-milter`, and `clamonacc`. The socket interface is documented and there are also a variety of third-party clients for `clamd`. See the Community Projects page for more details.
`clamdscan`	ClamDScan is a command line program to scan files and directories through `clamd`.
`clamdtop`	ClamDTop is a command line GUI to monitor ClamD.
`clamonacc`	ClamOnAcc is a daemon that receives on-access events from the kernel for real-time protection scanning through ClamD. ClamOnAcc is only available for Linux at this time.
`clamscan`	ClamScan is a command line program to scan files and directories that does not require the clamd daemon.
`freshclam`	FreshClam is the signature database (cvd) update tool.
`libclamav`	The ClamAV library enables you to build the ClamAV engine into your programs. The C programming API can be found in `clamav.h`.
`libfreshclam`	The FreshClam library enables you to build the signature update update features into your programs. The C programming API can be found in `libfreshclam.h`.
`sigtool`	SigTool is a signature database (cvd) manipulation tool for malware analysts and signature writers.

Target Type	Description
0	any file
1	Portable Executable, both 32-bit and 64-bit
2	OLE2 containers, including specific macros. Primarily used by MS Office and MSI installation files
3	HTML (normalized)
4	Mail file
5	Graphics
6	ELF
7	ASCII text file (normalized)
8	Unused
9	Mach-O files
10	PDF files
11	Flash files
12	Java class files

CL_TYPE	Description
`CL_TYPE_7Z`	7-Zip Archive
`CL_TYPE_7ZSFX`	Self-Extracting 7-Zip Archive
`CL_TYPE_APM`	Disk Image - Apple Partition Map
`CL_TYPE_ARJ`	ARJ Archive
`CL_TYPE_ARJSFX`	Self-Extracting ARJ Archive
`CL_TYPE_AUTOIT`	AutoIt Automation Executable
`CL_TYPE_BINARY_DATA`	binary data
`CL_TYPE_BINHEX`	BinHex Macintosh 7-bit ASCII email attachment encoding
`CL_TYPE_BZ`	BZip Compressed File
`CL_TYPE_CABSFX`	Self-Extracting Microsoft CAB Archive
`CL_TYPE_CPIO_CRC`	CPIO Archive (CRC)
`CL_TYPE_CPIO_NEWC`	CPIO Archive (NEWC)
`CL_TYPE_CPIO_ODC`	CPIO Archive (ODC)
`CL_TYPE_CPIO_OLD`	CPIO Archive (OLD, Little Endian or Big Endian)
`CL_TYPE_CRYPTFF`	Files encrypted by CryptFF malware
`CL_TYPE_DMG`	Apple DMG Archive
`CL_TYPE_EGG`	ESTSoft EGG Archive, new in 0.102
`CL_TYPE_ELF`	ELF Executable (Linux/Unix program or library)
`CL_TYPE_GIF`	GIF Graphics File, new in 0.103
`CL_TYPE_GPT`	Disk Image - GUID Partition Table
`CL_TYPE_GRAPHICS`	Other graphics files; BMP, JPEG2000
`CL_TYPE_GZ`	GZip Compressed File
`CL_TYPE_HTML_UTF16`	Wide-Character / UTF16 encoded HTML
`CL_TYPE_HTML`	HTML data
`CL_TYPE_HWP3`	Hangul Word Processor (3.X)
`CL_TYPE_HWPOLE2`	Hangul Word Processor embedded OLE2
`CL_TYPE_INTERNAL`	Internal properties
`CL_TYPE_ISHIELD_MSI`	Windows Install Shield MSI installer
`CL_TYPE_ISO9660`	ISO 9660 file system for optical disc media
`CL_TYPE_JAVA`	Java Class File
`CL_TYPE_JPEG`	JPEG Graphics File, new in 0.103.1
`CL_TYPE_LNK`	Microsoft Windows Shortcut File
`CL_TYPE_MACHO_UNIBIN`	Universal Binary/Java Bytecode
`CL_TYPE_MACHO`	Apple/NeXTSTEP Mach-O Executable file format
`CL_TYPE_MAIL`	Email file
`CL_TYPE_MBR`	Disk Image - Master Boot Record
`CL_TYPE_MHTML`	MHTML Saved Web Page
`CL_TYPE_MSCAB`	Microsoft CAB Archive
`CL_TYPE_MSCHM`	Microsoft CHM help archive
`CL_TYPE_MSEXE`	Microsoft EXE / DLL Executable file
`CL_TYPE_MSOLE2`	Microsoft OLE2 Container file
`CL_TYPE_MSSZDD`	Microsoft Compressed EXE
`CL_TYPE_NULSFT`	NullSoft Scripted Installer program
`CL_TYPE_OLD_TAR`	TAR archive (old)
`CL_TYPE_ONENOTE`	Microsoft OneNote Document section file
`CL_TYPE_OOXML_HWP`	Hangul Office Open Word Processor (5.X)
`CL_TYPE_OOXML_PPT`	Microsoft Office Open XML PowerPoint
`CL_TYPE_OOXML_WORD`	Microsoft Office Open Word 2007+
`CL_TYPE_OOXML_XL`	Microsoft Office Open Excel 2007+
`CL_TYPE_PART_HFSPLUS`	Apple HFS+ partition
`CL_TYPE_PDF`	Adobe PDF document
`CL_TYPE_PNG`	PNG Graphics File, new in 0.103
`CL_TYPE_POSIX_TAR`	TAR archive
`CL_TYPE_PS`	Postscript
`CL_TYPE_PYTHON_COMPILED`	Python byte-compiled executable (.pyc)
`CL_TYPE_RAR`	RAR Archive
`CL_TYPE_RARSFX`	Self-Extracting RAR Archive
`CL_TYPE_RIFF`	Resource Interchange File Format container formatted file
`CL_TYPE_RTF`	Rich Text Format document
`CL_TYPE_SCRENC`	Files encrypted by ScrEnc malware
`CL_TYPE_SCRIPT`	Generic type for scripts (Javascript, Python, etc)
`CL_TYPE_SIS`	Symbian OS Software Installation Script Archive
`CL_TYPE_SWF`	Adobe Flash File (LZMA, Zlib, or uncompressed)
`CL_TYPE_TEXT_ASCII`	ASCII text
`CL_TYPE_TEXT_UTF16BE`	UTF-16BE text
`CL_TYPE_TEXT_UTF16LE`	UTF-16LE text
`CL_TYPE_TEXT_UTF8`	UTF-8 text
`CL_TYPE_TIFF`	TIFF Graphics File (Little or Big Endian), new in 0.103.1
`CL_TYPE_TNEF`	Microsoft Outlook & Exchange email attachment format
`CL_TYPE_UDF`	UDF (Universal Disk Format) Partition
`CL_TYPE_UUENCODED`	UUEncoded (Unix-to-Unix) binary file (Unix email attachment)
`CL_TYPE_XAR`	XAR Archive
`CL_TYPE_XDP`	Adobe XDP - Embedded PDF
`CL_TYPE_XML_HWP`	Hangul Word Processor XML (HWPML) Document
`CL_TYPE_XML_WORD`	Microsoft Word 2003 XML Document
`CL_TYPE_XML_XL`	Microsoft Excel 2003 XML Document
`CL_TYPE_XZ`	XZ Archive
`CL_TYPE_ZIP`	Zip Archive
`CL_TYPE_ZIPSFX`	Self-Extracting Zip Archive

Flag	Value
HOST_SUFFICIENT	1
DOMAIN_SUFFICIENT	2
DO_REVERSE_LOOKUP	4
CHECK_REDIR	8
CHECK_SSL	16
CHECK_CLOAKING	32
CLEANUP_URL	64
CHECK_DOMAIN_REVERSE	128
CHECK_IMG_URL	256
DOMAINLIST_REQUIRED	512

Release Date	Release	FLEVEL	FunctionalityLevel (bytecode enum)	clamav lib	.so	freshclam lib	.so	API/ABI changes, major features, other notes
n/a	1.5.0	220	FUNC_LEVEL_1_5	n/a	n/a	n/a	n/a
Sep-2024	1.4.1	211	FUNC_LEVEL_1_4_1	12:03:00	12.0.3	3:02:00	3.0.2	Critical bug fixes
Sep-2024	1.3.2	202	FUNC_LEVEL_1_3_2	12:02:00	12.0.2	3:01:00	3.0.1	Critical bug fixes
Sep-2024	1.0.7	167	FUNC_LEVEL_1_0_7	11:00:00	11.0.0	2:02:00	2.0.2	Critical bug fixes
Sep-2024	0.103.12	133	FUNC_LEVEL_0103_12	9:05:00	9.0.5	2:01:00	2.0.1	Critical bug fixes
Aug-2024	1.4.0	210	FUNC_LEVEL_1_4	12:03:00	12.0.3	3:02:00	3.0.2	ALZ (CL_TYPE_ALZ) and LHA/LZH (CL_TYPE_LHA_LZH) archives archive extraction. Options to disable image fuzzy hashing.
Apr-2024	1.3.1	201	FUNC_LEVEL_1_3_1	12:02:00	12.0.2	3:01:00	3.0.1	Critical bug fixes
Apr-2024	1.2.3	193	FUNC_LEVEL_1_2_3	12:01:00	12.0.1	3:01:00	3.0.1	Critical bug fixes
Feb-2024	1.0.6	166	FUNC_LEVEL_1_0_6	11:00:00	11.0.0	2:02:00	2.0.2	Critical bug fixes
Feb-2024	1.3.0	200	FUNC_LEVEL_1_3	12:02:00	12.0.2	3:01:00	3.0.1	OneNote attachment extraction (CL_TYPE_ONENOTE); CL_TYPE_PYTHON_COMPILED (.pyc) file type recognition.
Feb-2024	1.2.2	192	FUNC_LEVEL_1_2_2	12:01:00	12.0.1	3:01:00	3.0.1	Critical bug fixes
Feb-2024	1.0.5	165	FUNC_LEVEL_1_0_5	11:00:00	11.0.0	2:02:00	2.0.2	Critical bug fixes
Oct-2023	1.2.1	191	FUNC_LEVEL_1_2_1	12:01:00	12.0.1	3:01:00	3.0.1	Critical bug fixes
Oct-2023	1.1.3	183	FUNC_LEVEL_1_1_3	12:00:00	12.0.0	3:00:00	3.0.0	Critical bug fixes
Oct-2023	1.0.4	164	FUNC_LEVEL_1_0_4	11:00:00	11.0.0	2:02:00	2.0.2	Critical bug fixes
Oct-2023	0.103.11	132	FUNC_LEVEL_0103_11	9:05:00	9.0.5	2:01:00	2.0.1	Critical bug fixes
Aug-2023	1.2.0	190	FUNC_LEVEL_1_2	12:01:00	12.0.1	3:01:00	3.0.1	UDF partition support
Aug-2023	1.1.2	182	FUNC_LEVEL_1_1_2	12:00:00	12.0.0	3:00:00	3.0.0	Upgrade UnRAR library for security fix
Aug-2023	1.0.3	163	FUNC_LEVEL_1_0_3	11:00:00	11.0.0	2:02:00	2.0.2	Upgrade UnRAR library for security fix
Aug-2023	0.103.10	131	FUNC_LEVEL_0103_10	9:05:00	9.0.5	2:01:00	2.0.1	Upgrade UnRAR library for security fix
Aug-2023	1.1.1	181	FUNC_LEVEL_1_1_1	12:00:00	12.0.0	3:00:00	3.0.0	Critical bug fixes; Fix build issue with Rust 1.70+; Fix build issue with openssl 3 on macOS
Aug-2023	1.0.2	162	FUNC_LEVEL_1_0_2	11:00:00	11.0.0	2:02:00	2.0.2	Critical bug fixes; Fix build issue with Rust 1.70+; Fix build issue with openssl 3 on macOS
Aug-2023	0.103.9	130	FUNC_LEVEL_0103_9	9:05:00	9.0.5	2:01:00	2.0.1	Critical bug fixes
May-2023	1.1.0	180	FUNC_LEVEL_1_1	12:00:00	12.0.0	3:00:00	3.0.0	Added `cl_cvdgetage()` and `cl_engine_set_clcb_vba()` functions.
Feb-2023	1.0.1	161	FUNC_LEVEL_1_0_1	11:00:00	11.0.0	2:02:00	2.0.2	Critical bug fixes; Fix an allmatch detection issue with the preclass bytecode hook.
Feb-2023	0.105.2	152	FUNC_LEVEL_0105_2	10:00:01	9.1.0	2:02:00	2.0.2	Critical bug fixes; Fixed an issue loading Yara rules containing regex strings with an escaped forward-slash (/) followed by a colon (:).
Feb-2023	0.103.8	129	FUNC_LEVEL_0103_8	9:05:00	9.0.5	2:01:00	2.0.1	Critical bug fixes
Nov-2022	1.0.0	160	FUNC_LEVEL_1_0	11:00:00	11.0.0	2:02:00	2.0.2	Added `cl_cvdunpack()` API. Added unstable `clcb_file_inspection` callback, and `cl_engine_set_clcb_file_inspection()` API. All-match mode is now more reliable. Fix logical signature "Intermediates" feature.
May-2022	0.105.1	151	FUNC_LEVEL_0105_1	10:00:01	9.1.0	2:02:00	2.0.2	Fix logical signature "Intermediates" feature.
May-2022	0.105.0	150	FUNC_LEVEL_0105	10:00:01	9.1.0	2:02:00	2.0.2	Fuzzy image hash subsignatures; Fix byte-compare subsignature premature alert
Nov-2021	0.104.4	144	FUNC_LEVEL_0104_4	10:00:01	9.1.0	2:02:00	2.0.2	Fix logical signature "Intermediates" feature.
Nov-2021	0.104.3	143	FUNC_LEVEL_0104_3	10:00:01	9.1.0	2:02:00	2.0.2	Critical bug fixes; Fix byte-compare subsignature premature alert (0.104)
Nov-2021	0.104.2	142	FUNC_LEVEL_0104_2	10:00:01	9.1.0	2:02:00	2.0.2	Critical bug fixes
Nov-2021	0.104.1	141	FUNC_LEVEL_0104_1	10:00:01	9.1.0	2:02:00	2.0.2	Critical bug fixes
Nov-2021	0.103.7	128	FUNC_LEVEL_0103_8	9:05:00	9.0.5	2:01:00	2.0.1	Fix logical signature "Intermediates" feature.
Nov-2021	0.103.6	127	FUNC_LEVEL_0103_6	9:05:00	9.0.5	2:01:00	2.0.1	Critical bug fixes; Fix byte-compare subsignature premature alert (0.103)
Nov-2021	0.103.5	126	FUNC_LEVEL_0103_5	9:05:00	9.0.5	2:01:00	2.0.1	Critical bug fixes
Nov-2021	0.103.4	125	FUNC_LEVEL_0103_4	9:05:00	9.0.5	2:01:00	2.0.1	Critical bug fixes
Sep-2021	0.104.0	140	FUNC_LEVEL_0104	10:00:01	9.1.0	2:02:00	2.0.2	CMake stabilized (autotools removed); Added db load/compile/free callbacks to clamav.h API.
Jun-2021	0.103.3	124	FUNC_LEVEL_0103_3	9:05:00	9.0.5	2:01:00	2.0.1	Critical bug fixes

ClamAV Documentation