Edit: /usr/bin/clamdscan (182096B)
ELF > @ @ @ 8 @ @ @ @ h h PC PC H H" H" 0g } " " D D Std Ptd ( ( ( 4 4 Qtd Rtd H H" H" g g /lib64/ld-linux-x86-64.so.2 GNU GNU GNU N߷'y[ e! ! BE
|qX 2 K ] g } f c 7 X d j < " / L ( g m 1 6 H | @ k + p ` k u / ` o < i V 5 $ S x $ ~ M > j 0 v { o - < v " P" " " " " H" libclamav.so.12 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable cli_newfilepath cli_ctime cli_strerror cli_regfree cl_retdbdir cli_strtokenize cli_chomp cli_regexec cli_safer_strdup cl_cvdhead cli_strntoul cli_realpath cl_cvdfree cli_get_filepath_from_filedesc cl_cvdgetage cl_retflevel cli_rndnum cl_strerror cli_regcomp cli_dbgmsg cli_ftw cli_basename cli_filecopy libc.so.6 setuid socket __xpg_basename fflush fchmod __printf_chk fopen gai_strerror strncmp ftruncate optind strrchr wait perror connect unlinkat __fdelt_chk initgroups strncpy fork __stack_chk_fail pthread_mutex_lock select strtoll memchr strpbrk getpid kill strftime localtime_r strtol lchown fgetxattr fgets getpwnam calloc renameat futimens strlen send sigemptyset getaddrinfo __errno_location bind read __syslog_chk dup2 __fprintf_chk sigaddset pthread_mutex_unlock stdout recv fputs lseek fclose __vsnprintf_chk malloc strcasecmp getenv optarg stderr __snprintf_chk optopt mkdirat __fxstat sendmsg fileno getcwd fwrite gettimeofday rename sigaction geteuid strchr flistxattr fdopen sleep __cxa_finalize syscall freeaddrinfo setsid fcntl __sprintf_chk fsetxattr openat __xstat getrlimit memmove access __fxstatat opterr setgid strcmp __libc_start_main stpcpy closelog __cxa_atexit _edata __bss_start _end CLAMAV_PUBLIC CLAMAV_1.1.0 CLAMAV_PRIVATE GLIBC_2.15 GLIBC_2.3 GLIBC_2.6 GLIBC_2.4 GLIBC_2.2.5 GLIBC_2.3.4
@ Ӈ_ `s " E /
> ii
I ii
S ii
] ui g ti s H" H" I" I" I" (I" 0I" 8I" @I" hI" h xI"
I" r
I" r
I" h I"
I" r
I" r
I" h J" (J" r
0J" r
@J" h `J"
pJ" r
xJ" r
J" J"
J" r
J" r
J"
J"
K" r
K" r
K"
(K"
HK" r
PK" r
`K" pK"
K" r
K" r
K"
K"
K" K" r
K" h L"
L" r
(L" r
8L" HL"
hL" r
pL" r
L" L"
L" r
L" r
L" L"
L" r
M" r
M" h M"
@M" r
HM" r
XM" + hM"
M" r
M" r
M" 2 M"
M" r
M" r
M" 9 M"
N" r
N" r
0N" F `N" r
hN" r
xN" h N"
N" r
N" r
N" w N"
N" r
N" r
O" $w O"
8O" r
@O" r
PO" v `O"
O" r
O" r
O" w O"
O" r
O" r
O" O"
P" P" r
(P" P HP" Y XP" r
`P" r
pP" i P"
P" r
P" r
P" s P"
P" H P" r
Q" { Q" 0Q" r
8Q" r
HQ" XQ" xQ" r
Q" r
Q" Q"
Q" r
Q" r
Q" h Q"
R" r
R" r
R" v PR" r
XR" r
hR" h xR"
R" r
R" r
R" h R" r
R" r
R" h S"
(S" r
0S" r
@S" PS"
pS" r
xS" r
S" w S" r
S" r
S" w T" r
T" r
T" w (T"
HT" r
PT" r
`T" T" r
T" r
T" T" r
T" r
T" U" r
(U" r
8U" hU" r
pU" r
U" U" U" r
U" r
U" U"
U" r
V" r
V"
V"
@V" r
HV" r
XV" hV"
V" r
V" r
V" V"
V" r
V" r
V" w V"
W" r
W" r
0W" @W"
`W" r
hW" r
xW" ! W"
W" r
W" r
W" + W" r
W" r
X" 7 8X" r
@X" r
PX" F X" r
X" r
X" V X" r
X" r
X" c Y" r
Y" r
(Y" i 8Y" XY" x `Y" v pY" { Y" Y" Д Y" r
Y" Y" Y" Y" r
Z" Z"
0Z" r
8Z" r
HZ" XZ"
xZ" r
Z" r
Z" Z" r
Z" r
Z" [" r
[" r
[" P[" r
X[" r
h[" [" r
[" r
[" [" Y [" r
[" r
[" \" Y (\" r
0\" r
@\" P\"
p\" r
x\" r
\" \" r
\" r
\" ]" r
]" r
]" H]" r
P]" r
`]" ]" r
]" r
]" ]" r
]" r
]" ^" r
(^" r
8^" h^" r
p^" r
^" ^"
^" ^" r
^" ^"
^" r
_" r
_" # 0_" . @_" r
H_" r
X_" 3 h_"
_" r
_" r
_" ? _" r
_" r
_" O _"
`" P `" r
0`" a @`"
``" h`" r
x`" `"
`" `" r
`" p `"
`" y `" r
a" a"
8a" @a" r
Pa" a" a" r
a" a" a" a" r
a" a"
b" ( b" r
(b" 8b"
Xb" r
`b" r
pb" b"
b" r
b" r
b" b" r
b" r
c" 0c" r
8c" r
Hc" xc" r
c" r
c" c"
c" r
c" r
c" ! c"
d" r
d" r
d" 1 0d"
Pd" r
Xd" r
hd" A xd"
d" r
d" r
d" L d"
d" r
d" r
d" R e"
(e" r
0e" r
@e" Y Pe"
pe" r
xe" r
e" a e"
e" r
e" r
e" h e"
f" r
f" r
f" p (f"
Hf" r
Pf" r
`f" x pf"
f" r
f" r
f" f"
f" r
f" r
f" g"
g" r
(g" r
8g" Hg"
hg" r
pg" r
g" g" g" r
g" r
g" g" g" r
h" r
h" 0h"
@h" r
Hh" r
Xh" xh"
h" r
h" r
h" h"
h" r
h" r
h" i"
i" r
i" r
0i" Pi"
`i" r
hi" r
xi" i"
i" r
i" r
i"
i"
i" r
i" r
j" (j"
8j" r
@j" r
Pj" pj"
j" r
j" r
j" j" & j"
j" r
j" r
j" 8 j" B j" k" P k" M k" S (k" a 8k"
Xk" p `k" r
hk" pk" k" x k" r
k" k" J% k" k" k" l"
0l" Ȗ 8l"
@l" Xl" xl" H l" l" l"
l" l"
l" l"
m" m"
m" 0m"
Pm" Xm"
`m" m" m" m" ' m" 0 m"
m" ; m"
m" S m" ] n"
(n" h 0n"
8n" h Pn"
pn" xn"
n" ~ n" n" ( n" n" n" o" H o" o" o" 8o" Y Ho" Po" Y Xo" `o" po"
o" 8 o" o" o" o" o" o" o" o" # p" (p"
0p" v hp" pp" . xp" E p" ț p" V p" a p" q" q q" u q"
@q" 8 Hq"
Pq" v hq" q" h q" q" v q" q" q" q" r" 0 r" (r" Aw @r" `r" p hr" pr" r" r" r" r" r" r" ` r" s" ` s" 8s" @s" Hs" `s" s" О s" s" s" s" H s" s" s" t" ؟ t" t" 8t" Xt" ` `t" ht" t" t" t" t" t" t" 8 t" r t" 0u" 8u" @u" +w Hu" , Xu" xu" u" > u" Qw u"
u" A u" u" iw u"
v" @ v" v" |w v" \ 0v"
Pv" h Xv"
`v" e xv" v" v" o v" s v"
v" v"
v" v" w"
(w" إ 0w" 8w" pw" xw" w" w"
w" w"
w" w"
x" Ȩ x"
x" x" (x"
Hx" Px" Xx" px"
x" x" x" # x"
x" x" x" 7 y"
y" P (y" 0y" L hy" py" b xy" Q y" y"
y" ت y"
y" Z y" k y" y" z" z" z" z" @z" ج Hz" Pz" Xz" hz"
z" z" z" z" z" H z" z" p z" z" z" z" {" Ю {" ({" 0{" @{"
`{" x h{"
p{" * x{" 5 {" {" A {" P {" [ {" P {" g |" w |" ~ |"
8|" @|"
H|" P|" `|"
|" @ |"
|" |" |"
|" 0 |"
|" |"
}" г }" }" (}" { 8}"
X}" ȴ `}"
h}" p}" }"
}" ( }"
}" }" }"
}" p }"
}" ~" ~"
0~" 0 8~"
@~" 5 H~" M X~"
x~" ȸ ~" ~" _ ~" | ~" ~" ~" ? ~" ~" ~" " P " ? " 0"
P" X"
`" x"
" " " " "
" x "
" "
"
(" ( 0"
8" @" . P"
p" x"
" ; " L "
" "
Ȁ" _ Ѐ" n "
" 0 " " ~ " ("
H" P" X" `" p"
" " " " "
" P " " " "
" (" 0" 8" , H"
h" p" r
x" ? " R "
" " " g Ȃ" "
" "
" " "
@" 0 H"
P" X" h"
" "
" " "
Ѓ" "
" " "
" 8 "
(" 0" @"
`" h"
p" x" "
" h "
" " ) Є"
" "
" 4 " G "
8" @"
H" ] P" i `"
" " " w " " ȅ" Ѕ" " " " " " " " (" 0 8" X" `" h" " p" " " X " " " " Ȇ" " " " " " 0" 8" @" H" X" x" " " " " " ȇ" % Ї" ( ؇" ; " " " O " S " a 0" P" X" p `" s h" x" " " " " " " " " " " (" 0" 8" @" P" p" x" " " " " " ȉ" Љ" + " " " " = H" P" O X" \ " ` " p " ؊" " " "
" (" 0" H" h" p" x" " @ " " ؋" " " " "
@" H" P" h"
" ` "
" ' "
Ќ" ،"
" = " " h " Q (" X @" `" h" p" k " " p " % " Ѝ"
" "
" 8" r
@" r
P" " r
" r
" " "
Ȏ" r
Ў" r
؎" " " " r
" r
" (" 8"
X" r
`" r
h" p" "
" r
" r
" " J% " " " 4 "
" B 0" ( 8" B @" M H" T X" x" " " [ " k " Ȑ" k А" " ( " " P" X" `" x" " " ? " "
" P "
" "
(" 0"
8" P"
p" x" r
" " " Ȓ" " P " " ! H" P" 8 X" 3 " x " C " N " ؓ" \ " n " s " (" 0" h" p" &w x" " " 7 " Ȕ" "
" "
" " @" H" P" X" ! " h " " ! " $! Е" ؕ" " 8! " G! " ( " U! (" e! @" `" h" p" t! " " " r " Q Ж"
" "
" ! " ! "
8" @" H" ! `"
" " " ! " ! " ȗ" З" ؗ" ! " ! "
" " " ! (" ! 8"
X" @ `" h" " p" " "
" r
" r
" " 2 Ș"
" " " " " X "
0" 8 8" @" l H" X"
x" " " 1" " A" "
" ș" Й" N" ؙ" d" "
" " " t" P" r
X" r
`" " " r
" r
" " " r
" r
" " (" r
0" r
8" " p" r
x" r
" " "
" r
" r
ț" " "
" r
" r
" " " # ("
H" r
P" r
X" # p"
" x " " 8# "
" r
" r
" E# " (" Q# 0" k# h" @ p" p x" x# " " V " # " " q " # @" H" 8 P" # h" h x" # " " # " # " h " # О" ؞" # " # " # " # " @ " # (" # `" h" # p" $ " $ " " " &$ " .$ " ( " =$ " Q$ 8" @" H" ]$ " " d$ " m$ Ƞ" h Р" w$ ؠ" $ " h " w$ " $ X" ( `" x h" $ " " $ " " " $ " $ "
0"
8"
@" N" X"
x" r
" r
" " r
Ȣ" r
Т" "
" r
" r
" ! 0"
P" r
X" r
`" # x"
" r
" r
" v " r
" r
" " "
(" r
0" r
8" " P" p" r
x" r
" " " " r
" r
Ȥ" " " " r
" r
" ("
H" r
P" r
X" p"
" r
" r
" "
إ" r
" r
" "
" r
(" r
0" H"
h" r
p" r
x" w "
" r
" r
" Aw ئ" " r
" r
" v @" r
H" r
P" v h" " r
" r
" Ч" r
ا" r
@" ^% P" g% `" t% p" }% " % " % " % " ' " % Ш" ^% " % " % " % " % " % 0" % @" % P" % `" % p" " & " `I" " " " X ȯ" s Я" { د" | " ȫ" Ы" ث" " " " " " "
" " "
(" 0" 8" @" H" P" X" `" h" p" x" " " " " " " " " " ! Ȭ" " Ь" # ج" $ " % " & " ' " ( " ) " * " + " , " - (" . 0" / 8" 0 @" 1 H" 2 P" 3 X" 4 `" 5 h" 6 p" 7 x" 8 " 9 " : " ; " < " = " > " ? " @ " A ȭ" B Э" C ح" D " E " F " G " H " I " J " K " L " M (" N 0" O 8" P @" Q H" R P" S X" T `" U h" V p" W x" Y " Z " [ " \ " ] " ^ " _ " ` " a " b Ȯ" c Ю" d خ" e " f " g " h " i " j " k " l " m " n (" o 0" p 8" q @" r H" t P" u X" v `" w h" x p" y x" z " } " ~ " " " " HH " HtH 5" %" h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h h h h h q h a h Q h A h 1 h ! h h h h h! h" h# h$ h% h& h' q h( a h) Q h* A h+ 1 h, ! h- h. h/ h0 h1 h2 h3 h4 h5 h6 h7 q h8 a h9 Q h: A h; 1 h< ! h= h> h? h@ hA hB hC hD hE hF hG q hH a hI Q hJ A hK 1 hL ! hM hN hO hP hQ hR hS hT hU hV hW q hX a hY Q hZ A h[ 1 h\ ! h] h^ h_ h` ha hb hc hd he hf hg q hh a hi Q hj A hk 1 hl ! hm hn ho hp hq hr hs ht hu hv hw q hx a hy Q hz A h{ 1 h| ! %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %}! D %u! D %m! D %e! D %]! D %U! D %M! D %E! D %=! D %5! D %-! D %%! D % ! D %! D %
! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %}! D %u! D %m! D %e! D %]! D %U! D %M! D %E! D %=! D %5! D %-! D %%! D % ! D %! D %
! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %}! D %u! D %m! D %e! D %]! D %U! D %M! D %E! D %=! D %5! D %-! D %%! D % ! D %! D %
! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %! D %}! D %u! D %m! D %e! D %]! D %U! D %M! D %E! D %=! D %5! D %-! D %%! D % ! D AUHA AT1A USH` dH%( H$P 1D$ D$ j { _AXH H5 HH_z p H5 HEz 1E1HxPA 1j g{ ZYH! H H5Y Hz x tf?
" fV
" H5< Hy x t f
" H5$ Hy x t f " H5W Hy x tUH Hy H=F! y 1Hy 5 H5Y 1 hH5 H9y x tH5 H$y h H5 H
y x t
" H5l Hx x H& " HH5L x H߃x uhYQ / H y H=j! x H5Я Hx H5 HP1H Hx v H߉x H=! x 薔 OH
ftf " EHix H=! ]x e H5L H1;IH@1H5! H " 1蛘 H5, 1 ` Hw H=Y! w H$ $ L$ HDŽ$ HHH
1L
1H|$ 1HD$ HT$ Ht$HN H=! A_w H5 Hv h tD H
! Ht H=y! H5r! H)HHH?HHtH! Htf D =5! u+UH=! Ht H=! d
! ] w PX 1H5 HfU" 1ʐ a 1H5 H1貐 11H5/ 袐 11H5o 蒐 11H5 肐 11H5 r 11H5 b 11H5 R 11H5 B 1H5 12 1H5 1" 11H5W 11H5 11H5 11H5/ 11H5_ ҏ 11H5 11H5W 貏 11H5 袏 11H5ׯ 蒏 H5 11肏 H5S 11r H5 11b H5Ӱ 11R H5 11B H5K 112 H5 11" H5 11 1H5B 1 1[f. AWEAVIAUATEUH SHt$HT$H HHl AŅ H߾ HH H!%t¾ I LU DHWHD HH1H))HcHcHƃ Et;DL$PHT$ELt$H AH4HD[]A\A]A^A_fDL$PHT$ELt$H4 A HH| H5 1E1誑 H5 菑 HnfAWH5ǵ AVAUATUSHxH=L! dH%( HD$h1op p H=%! H5 Qp X u*H\$hdH3 %( Hx[]A\A]A^A_ D H=! H\$^Ld$ H5D p LB
HLH
1H\$:H=! H5 o HHD$H$HL E1HEHt Hƹ H= IDH $Ht$fLHAD$AD$Ml$$AD$, D$( D$ Å Lt$MuH f D AFIvt
u1fFAVD DMv(MtCAV AvA~ADžy>8H5 1H1蔏 Mv(Mu Lt$L;Hm0& D yH5" H1S Hm0H1 Ls" H1Hc" IxL1H" HH)lH Lf
." Hrl " @ [D8bt#H|$ of. H|$QbG AWAVAUATUSH H $ HX dH%( H$H 1HD$ H H5 IKm IH LhM L:IH : HqHt 8 @ A Hl$LH
LHLHrLH9D$s+H5 1萍 A HD$ 1H$H$B HD$H=A! tP ADžy}HH5ԣ LH9 Ql @ F H5 11 MtL$H$H dH3 %(
HX []A\A]A^A_f G H<$DŽ$B zPINf$F J Ht$ DKG H5 1而 D& k P t,ItFLH5$ 1H D It:LH5h 11 D H5 1 f D H5 11 뙐H5 11 ˋ f D H5K Lj H td1 HXHl$HO
HHHHI1HH9D$H5 1K :H5 1114 H5 D E11H5 1 ff. AUATUSH H $ HH A dH%( H$8 1Ƅ$7 HzVERSIONH$/ H=\! M xcH\$AHl$HdH H$/ DD AŅtnf D tKH|$1HHTH uD8H$8 dH3 %( Du:HH []A\A] @ H5 1͉ DA s ATUSH H $ H@ dH%( H$8 1HzRELOAD H$0 H=G! zL xpLd$ÉLUG H$0 C uu1Ht$L^G ~HRELOADINHD$H9tEH5 1 H$8 dH3 %( u"H@ []A\ D xGu1jf. AWIAVAUIH5 ATUSHH dH%( H$ 1g p HC@Ht#H0Ht H= L 1H5ܬ HA3g D ` H=! H5 Hg P H5 HE1f @ AE H5 HA f D` H=! H5 f H=s! H5 H@HD$f H=W! H5y H@Hu! xf H=9! H5s P EЉ$T$Qf $@ AE D$H{@ $D$J H5 H f DP E^ f D 1HX HtU HH=l HDHEL$LQDD$Lx_1AXHIX HuAU 1H$ dH3 %( V H []A\A]A^A_ D AE
1HT$ l D$8H=! % = DEI Åy;E] Euz j H5 1譅 5! E111j DLL$,K D$,]A\ AE A] @ f D Hff" EH=! H5b $*d $@ t@uH5٩ HA
d D p t0H5 HA c D` !f D A A H5 HA c @ H5R HE1c Dp EA f. H5 1M a H5 HQc @ %H5 H7c @ H5ب H c 1Dp E'f H5 Hb H HC@1Hx @fH5] Hb DH EtHH{@ H51 1m AE HLDED$LH=g> PDD$Y^8uHS@H5 1H1H f. fUSHH dH%( H$ 1H=! H=! HH5ާ a P HC C H}! C HC HtHH5 kt?tHH Pt\ @ H$ dH3%( uSHĨ [] H|$0 uH$CHCf1HG fG HG D H$CHCff. fAWAVAUATUSH H $ HX 1ۋw0dH%( H$H 1Ld$0IL? HD$(HD$HD$ HD$IE@HD$ f H HLpHhA~:H|$ : H HT$(z FOUHJ 9 ERR\ LHt H5 HAEHtAEHH;HGH|$ HL9$8 w HT$Ht$L> ADžF J H|$
1 IU@Ht#;u. f D 9 HHBHuH5 11 H$H dH34%(
HX []A\A]A^A_ fzNDAE HL1AE8 H5f 1 H! HHtdHLf. fyORAE(HL1AE8 H5 1q p @ HZ Lp{ 1H\$HH5 ATIUHSH H5! dH%( H$ 1? ulHt} u7} t } uc H$ dH3 %( uqHĠ []A\ HL uHEH9$uf. f HL Pu1HEH9$z D HtH6ff. @ AWAVIAUATIUSH IdH%( H$ 1L|$ HD$ LG2 Ht$L:Ll$ HLAu;C, H
HcH> {$H=R! t @ 1H|$Ht_LWH$ dH3 %( H []A\A]A^A_ @ LH5 1M | Mf. LH5 11 | C0q H5 11| Pf D H=! LLL 3 ? H=U! ? AąV HC0LK(MD$ H.! A L H5I 1 | C0 LH5 11 { C0M @ H=! DD$ > AąyC0 lf. DD$ D$ HC01H! LK(s$RDLPA DAXZEx3Dk D|$ L,0 C0 ։L H5 H1{ C0C0 ff. AWAVAUAATUHSHH8 IdH%( H$( 1Ht$HD$ 9Ld$ HLu%C$A' H JcH>f D E1HtHxH|$HtiH$( dH34%( D H8 []A\A]A^A_ D HH5 1I y ^f. HH5 1E1 y C(if D H5 1E1y H D H5 1A y C(!f D HH5 1E1 gy C(f D E1H=E! uqf Hx CL9CHs述 IH HLH/ t(HH5Ɵ 1E1 x C(h f D HD$ H$H$ HD$A H<$1LHHc{0A S0 :L?)H|$HLH T 1HHc{0y{0H4$E1 ?)LHH Ġ HT$1 x|Hc{03Hc{0 ?)LHHT {0 ?)ILĠ C, C8 E1C(1;8H5 H1w A MLN, LHf D A A 8H5̝ H1w C(M Au7 ~e H s4E1VS4HS@HhLhHPHC@M`CHWH! MtAHAuIU 9 뗃C(EC8 AA/LW8 hL8 [8H5j H13v ff. USHH_@HtOHf D HCH{HE@H{Ht* H{ EHtEHHH]@HuH[]ff. AWAVEAUIATIUHSDHhdH%( HD$X1! L|$t$4HLDL$DED$0 D$8HD$< D؉\$HYLD$DL
H
!HL|$$T$0AU T$@A$u t<t7\$M LLŅ HSDH=* 1S f D LDŅ tuyM HC LLmŅ H{ ulH! H H H9tFH H9t:[L]LA\A]A^G []A\A]A^ D []A\A]A^1[]A\A]A^ []A\A]A^H{Ht
RHC H! H\ H H9tHm
H9Zf% = @ t
1 USHH.89t 1H[] ?USHHt5-s! t*/ H=HHPHEH1H[] H[]f ATAUS D 8u1D
HHtH[]A\f AWAVAUATUSL$ H H $ L9uH(HT$@t$dH%( H$@ 1H AHH Hl$ / HHIHr L-< # L1CADž 8tA Eu~E1Kf. DAA DE`JT H5\ 1 h IM9s8Jt > t|$ uIFL9u1ɺ DAIxHD$E1D8HH$@ dH3 %( D H(@ []A\A]A^A_ DH5j 11Aeg JT1H5; 1Kg DsrH5 A,g cH5؏ 11Ag @H5u 11Af -ff. ATAUHS @ [8u HDÅx[]A\f AUAATIUHSH
8u A HLD EÅxH[]A\A]fAUATUSHxrxnAIHHLu&HLDvuHM H9 t! H[]A\A]f D HMH9KuH[]A\A] [ ff. AUIATAUSH8 dH%( H$( 1H$ HIH$upHs H{ctGHu H}Rt6 LDH$( dH3 %( u2H8 []A\A] D
f D @ AWH AVAUATUSH H|$L$ H4$LdH%( H$ 1D$$HD$( HH H\$HT$$ H\ H,HT$(HHLŅ Dl$$HE Ƅ$ L53 D;A bAzU` MAWLcȺ ` L1XLDY^uHl$0LDHu(Hu H}
A
D D;DHT$H5I 1H1ec H|$(HtKvA|$$trH$ dH3 %( D HĘ []A\A]A^A_f D ALDŅxpL$P LDL$ MLuHD$0H9$ D;LDD; A L$P LDD3LuHD$0H9$P O D3DA覿HT$1H5 H1.b H|$(Ht @ ;$ u1 @ |$$L:tދ;t:L H5c H1a HT$8H9$ H;$P H;$X Iw I Iv I~n fo> L$ c t LDŽ$ e-sr)$ f$ )$ DŽ$ e-dsf$ ,t@HT$H5$ 11A` _ H|$(H D H$ HHD$umLd$Ld$ um1A ML< xLd$ LHt$ _ 9 L$Ld$ LL$dHt$ SL$t ;U Ht$(|$$L4x6 $ % = H$HH9$ H@H9$ Ll$(D|$$ ; LLDExt f. ; Ht$(Lx $h Ll$(% = H$HH9$P uuH@H9$X ugL1҉5AŅ;A-HT$H5 1H1^ HT$11H5Z A^ Dt$$E M E1LDL` ;u] ;uOLA MD< 1ĺ
xօu& HT$11H5 A] ;MHT$H5 1H1] 1LHT$H5E 11] BH5 1] /;fHT$1H5 H1Am] ;f D 軺HT$1H5e H1A=] X;f D 苺HT$1H5u H1A
] (HD$8H9$X Iw I LD t
d @ AUATUSHH H/LgHL HHHDMt Au3EuvHH5k 1@\ H)! H[]A\A] C0% = uHsL uEtTHLH1[H5 ]1A\A][ @ LHH5 1 [ D H- ^ @ HHH5ٍ 1[1]A\A][ AWAVAUATUSH H $ H H $ H H|$HT$ dH %( H$ 1H A HD$H $ @0D$% = Y <$1H 1DHt{H$ [8uf<$ HHHxtzE1f INd= M)
8u&LLDHxtII9r H$ dH3 %( [ H []A\A]A^A_þ DH
諶8uHD xu1DHt<$Ht$PXuo$ H\$0o$ )D$0)L$@K8RHDgxt< @ # <$11HHx< H6HHu u f ۵ <$HH袻HxHHHD$H9r 蛵 <$11HѹIHx L諺IIHu S <$LLH臹HxI D # W E1LLHDx2 L肹HH\H;\$JHb˴8 DxHL$ HHT$oR)ob()aor8)q oRH)Q0obX)a@orh)qPoBx)A`o )Qpo )$$) K1 6_VH5 H1kW 4=H$r$Ń_uE1E1ó LD$,ED$,
_uLD$,D$,=u褷o Pc off. AWAVAUATUSHh dH%( H$X 1D$$HD$( Hn L'LwHA IMLDMT =! D$G A 9 AG0% = % LݹH$HHv hHI轳Hc! H|輷HH@ HL! M1H
H$Ld$MLt$Mhf+8 HL! M1UH
X HHֳ/ HZYHLHLD˃M IwE1LD-! D tMDLd$H$ LLt$T $ % = u IGH9$ uIG H9$ I H< H<$践Ht$(LzD$$ LD$(M |$ e LLH5 1 LT H9! H|$( HT o|$$xF K8f L%څ LH5u 1S H! |$$yH|$(HtH$X dH3%( Hh []A\A]A^A_f Ld$Lt$H讴H<$襴H\$0LHH|$$,_ |$ LS! LLH5 1 S H ! H|$( LLH5 1 R f|$$ |$ L! t"LLH5 1 R P @ LLH5K 1 R .f. {
AoGAoO(H\$(AoW8Ao_HAogXAooh)D$0AowxH<$)L$@Ao )T$PAo )\$`)d$p)$ )$ )$ )$ tW|$ L! t)LLH5$ 1 Q H|$(LLH5S 1 Q D Ht$0LtG|$ 趮LL IH5I 1:Q >| @ |$ LD$(tI I f D H5os 1A@ of. M M RH5t 1A? 4ff. @ ATU SHt@IHH5
HË@ t"f D HsL| ŃtH[0Hu1[]A\ LH5r 1J? []A\ USH dH%( HD$x1D$W HzFILDES HD$X1x Ht$X¸t#HL$xdH3 %( HĈ [] D HD$WfHHD$@HD$`HD$ HD$@HD$H \$pHD$H )$HD$0 HD$ HD$( HD$` HD$h舝Hø H[њ8蚛H5q H1$> 2؞ Ht7AT1USH1H貜Aąx+D[]A\Ð1f HH5Aq 111= []A\ @ E1 @ A HtWAU1ATIUSH1HHAŅxBHLƉEtDdH[]A\A] H11t @ HH5.r 11< 1H[]A\A]ff. AWH5#a AVAUATUSHHhdH%( HD$X1 P t 1Ҿ H蔙ADž HH5` Ld$N L`
LLH
1њHH5` b HH3 Hl$L-` C L{Mt LL f1HL$H)E L)E)E D$ 肝 Lt$M AV AvA~諘ADž` AVIvx5H|$CHL$XdH3 %( Do Hh[]A\A]A^A_ D 8謘HS H5p H12; DZMv(MaLt$LМH[0HAu fHL$HL)E L)E)E D$ uƜHL 1H5Fn : H[0 H5ɭ! n ͙ 8ɗHU H5o H1O: Dwf˖8蔗H5m H1 : f L=9 G踚 AWAVAUATUSH H $ H H$0 L$8 t$(AHHL$LL$HD$DD$/dH%( H$ 1HM HH$ AHHD$ xA H
o DHcH>Hl$ H} HH
0! IHcD$(L,LٖE|IcܚHD$0H HIMHH
l 1KHt$0DD{H|$0 ٙE( E1Ll$8Ld$0E1f D A MLLHu HuHT$0H5O 11 $A I8 $~Lt$0: LΘHH x t; Lt$0( L觘Ht Lt$0: L荘HHI HD$8x FOU x ERR A * HD$H7 pDWAE HD$Ht HD$Ht H$ dH3 %( D H []A\A]A^A_ H$ H6D$( H
m HcH>f D EuH HT$@H Ã6 D$X% = @ VHH5j 116 f D A2 D E1HD$HT$ LDpAHl$ HDPALHDHl$ A D fxND]H|$ @ t HD$ |$( AH|$ 8|$( HT$011H5i H $5 H $|$/ H! H|$H HH @ H=zi L G D$(HIi wHcH@,! HH5]k 11AF5 Ht H5U! HH $IH $ H|$ OHT$ 11H5 i 4 |$/ /H! H H Ht$HHfxORHD$Ht HD$Ht HT$ H|$(~H5Z 11x4 LH5K 11`4 HH=l! AS\! H $LH5'h 11 4 A0A萐A8SH5i H13 mH5g 11A3 TH5`i 11A3 9_*Aߋ8HH5i 1H1z3
D PX1H蟔ff. @ Hi @ AWAVAUATUSHiH11j E1A 1H=i He ZYHr H5i HH Iŋ@ u.H薖HIK HL[]A\A]A^A_f MuHLtLUHIJI| PIHR HǾ 1MH
,i HĐ L藕 L肕 LIH L1IH
h Hf L9 L$ L贔IH LВAGA9FvImLJLB D HH[]A\A]A^A_2fL舒 MEH
.h L1H 诏f. LHImH! . H=h H2IH
g L1H M AVAUATUHSHdH%( HD$1H _Hx fHH IE1 H1MH
MuMl$(M2 Hl$XHLHHB @ M T$@$DL$ HMHU Hu! H81{D$DD9AL= w BƄ P HcD$DHD$ HHDŽ HDŽ DŽ DŽ yHcu! ) H=Q H{H|$X@HD$ H$ dH3<%( HD$u H []A\A]A^A_tH M 1Ht$hLt} "HK HD$h wHl$Xt H= L _ E1 IL$HS 1y1HcHH Hs! * H=P HWzH|$XHD$ xIm" HvH/ A} IM t$@DL$ MHHR jHl$X1D$@mH4s! ED$IL$H8EtwHS 1x;A} Hr! ED$IL$H8E! H T 1xLH5 u1ɅE1{HR 1WxE " Hr! HIH8M` HT 1xHl$XHGr! H8M ED$IL$E HT 1w f. HH5 1
9 A A H$ H 1H |X H_j! f8 HH 1ZI} H/j! f8 H 1Hd X 1XS8_ H= 2Z'XSH$ 8HVI 1HH5 SH=i! UME3^d! AWAVAUAH= ATIUDSHHhH $LD$QRH 1A+ + Hc! H HN! DE9" McNJ HD$A <- @+ @-u
D IE9c NA Mc<-uAx tHBN! ALHLD$H $DD\$D0D\$HN! E9 Hc0EFHD)LH NLD9~ AGHH @ HPHHPH9uILLHHE9|E)HM! AD* Ax D H}M! ADE9}
HeM! D(Hh[]A\A]A^A_ D E<$A:A4FըaA:THcE<A:D= f Ax@-I@N Ha! 8-taAx uZf. HcrAtAHcA :p ;u Wb 9uHhLHD[]A\A]A^A_1Ax-@ID @D0HD$|$@A=* E! GH
A=tE4 HEuT$DH4$LLL$HM D$D+D$@D|$'1HLD$(HD$PD\$0Dl$4IH\$8LLd$XIĐHKL9 HcHI\ HuLD$(D\$01E1D|$'H$Dt$(Dl$4H\$8D\$0Ld$XLt$LD$Hh D|$'1L|$PH|$HDl$4IH\$8Ld$HE̐LLKuDI I}AHuډD|$'Dt$(LD$D\$0Dl$4H\$8Ld$H g HJ! ? FHJ! AH H DH-J! H81OHsJ! D H]J! A DHv_! L LHDH+J! D JHcA<4:D$@D$D Ht$LHI9D|$'LD$(D\$0Dl$4H\$8HcH$HHBA= HD$Ht8HBjH (HoI! 1DHcI! AD|$@
HAI! ? H/I! AH H D HI! ? 0tH LHN HH! H81@NHH! DcHH! ADE9|IHH! 1A:@ŋl:1LH H 뚋D$DH5]! HLHHD$H5]! HDHff. E14 @ A ! AWIAVIAUAATL% UH- SL)H>Ht 1 LLDAHH9uH[]A\A]A^A_ff. f. H 1>I HH help config-file quiet stdout ClamAV %s
ping wait infected reload no-summary Infected files: %d
Total errors: %d
Not removed: %d
Not moved: %d
%Y:%m:%d %H:%M:%S Start Date: %s
End Date: %s
Clam AntiVirus: Daemon Client %s
By The ClamAV Team: https://www.clamav.net/about.html#credits
(C) 2024 Cisco Systems, Inc.
clamdscan [options] [file/directory/-]
--help -h Show this help
--version -V Print version number and exit
--verbose -v Be verbose
--quiet Be quiet, only output error messages
--stdout Write to stdout instead of stderr. Does not affect 'debug' messages.
(this help is always written to stdout)
--log=FILE -l FILE Save scan report in FILE
--file-list=FILE -f FILE Scan files from FILE
--ping -p A[:I] Ping clamd up to [A] times at optional interval [I] until it responds.
--wait -w Wait up to 30 seconds for clamd to start. Optionally use alongside --ping to set attempts [A] and interval [I] to check clamd.
--remove Remove infected files. Be careful!
--move=DIRECTORY Move infected files into DIRECTORY
--copy=DIRECTORY Copy infected files into DIRECTORY
--config-file=FILE -c Read configuration from FILE.
--allmatch -z Continue scanning within file after finding a match.
--multiscan -m Force MULTISCAN mode
--infected -i Only print infected files
--no-summary Disable summary at end of scanning
--reload Request clamd to reload virus database
--fdpass Pass filedescriptor to clamd (useful if clamd is running as a different user)
--stream Force streaming files to clamd (for debugging and unit testing)
Can't parse command line options
Can't parse clamd configuration file %s
--------------------------------------
Problem with internal logger.
----------- SCAN SUMMARY -----------
Time: %d.%3.3d sec (%d m %d s)
Failed to get local time for Start Date.
Failed to get local time for End Date.
Can't make room for fullpath.
Can't get absolute pathname of current working directory.
Can't lookup clamd hostname: %s
isremote: socket() returning: %s.
could not allocate memory for string
interval_str would go past end of buffer
attempt_str would go past end of buffer
Could not connect, will try again in %lu second
Could not connect, will try again in %lu seconds
Could not connect, will PING again in %lu second
Could not connect, will PING again in %lu seconds
Wait timeout exceeded; Could not connect to clamd
PING timeout exceeded; No response from clamd
Error occurred while receiving version information.
Clamd did not reload the database
--allmatch is ignored when quarantine actions are enabled.
client.c: fstat failed for file name "%s", with %s
. Only scanning files from --file-list (files passed at cmdline are ignored)
Scanning from standard input requires "-" to be the only file argument
LocalSocket TCPSocket %lld TCPAddr any null parameter was passed
PING failed...
PONG
RELOADING - file-list stream allmatch copy remove multiscan fdpass MaxDirectoryRecursion StreamMaxLength FollowDirectorySymlinks FollowFileSymlinks CrossFilesystems /proc Bogus session id from clamd
Failed to parse reply
FOUND %s%s
ERROR Can't access file %s
%s: Not supported file type
%s: OK
%s: No files scanned
Failed to determine real filename of %s.
Memory allocation failed in ftw
Directory recursion limit reached
Can't open file %s for safe quarantine action: %s
Failed to allocate action source: %s
Can't open file %s for safe quarantine action.
select() failed during session: %s
Failed to allocate scanid entry: %s
Clamd closed the connection before scanning all files.
[[H\p\([[[_]^^]l^^action_cleanup: Failed to unlink quarantine lock '%s': %s
action_source_populate_posix: Resolved action path for fd [%d] is: %s
traverse_to: Invalid arguments!
traverse_to: Failed to get copy of directory path to be tokenized!
traverse_to: tokenize of target directory returned 0 tokens!
traverse_to: Failed to open file descriptor for '/' directory.
traverse_to: Handle opened for '%s' directory.
traverse_unlink: Invalid arguments!
traverse_unlink: Failed to get basename of target path: %s
Error: %d
traverse_unlink: Failed to create private unlink directory for '%s': %s
traverse_unlink: Refusing to capture '%s' because no-replace restore is unavailable.
traverse_unlink: Failed to restat '%s' before capture: %s
traverse_unlink: Refusing to capture '%s' because the source changed after validation.
traverse_unlink: Failed to capture '%s' before unlink: %s
traverse_unlink: Failed to restat captured '%s' before unlink: %s
traverse_unlink: Failed to restore captured replacement for '%s': %s
traverse_unlink: Refusing to unlink '%s' because the captured source does not match the scanned file.
traverse_unlink: Failed to unlink captured source for %s
Error:%s
traverse_unlink: Failed to remove private unlink directory '%s': %s
Can't remove file '%s' (real path: '%s')
%s (real path: '%s'): Removed.
action: Failed to preserve extended attributes: %s
Can't move file '%s' (real path: '%s'): quarantine destination '%s' is unavailable
Can't move file '%s': quarantine destination '%s' is unavailable
Can't unlink '%s' (real path: '%s') after linking into quarantine: %s
Can't unlink '%s' after linking into quarantine: %s
%s (real path: '%s'): moved to '%s'
Can't move file '%s' (real path: '%s') to '%s'
Can't unlink '%s' (real path: '%s') after copy: %s
Can't unlink '%s' after copy: %s
Can't copy file '%s' (real path: '%s') to '%s'
Can't copy file '%s' (real path: '%s'): quarantine destination '%s' is unavailable
Can't copy file '%s': quarantine destination '%s' is unavailable
%s (real path: '%s'): copied to '%s'
.clamav-quarantine-lock.%lu.%u action_setup: Failed to create quarantine lock file in %s: %s
action_setup: Failed to create quarantine lock file in %s after repeated name collisions.
action_setup: Failed to register cleanup handler.
action_setup: Failed to get realpath of %s
'%s' doesn't exist or is not a directory
action_setup: Failed to open quarantine directory handle for %s
(null) %s/%s %s/%s.%03u traverse_to: Failed open %s
.clamav-unlink-%ld-%u-%u Can't remove file '%s'
%s: Removed.
%s: moved to '%s'
Can't move file '%s' to '%s'
Can't move file '%s'
Can't copy file '%s' to '%s'
%s: copied to '%s'
Can't copy file '%s'
(unknown) .rename-noreplacCan't send to clamd: %s
STDIN Failed to read from %s.
UNKNOWN COMMAND
Communication error
Overlong reply from clamd
%s: Excluded
FD send failed: %s
%s: Failed to open file
Could not lookup %s: %s
Can't create the socket: %s
unidentified z%s %s UNKNOWN COMMAND Failed to parse reply: "%s"
%s%s FOUND
STDIN: noreply from clamd
. %s: no reply from clamd
CONTSCAN MULTISCAN INSTREAM FILDES ALLMATCHSCAN %s: File size exceeds StreamMaxLength; refusing to send a truncated quarantine stream. ERROR
Command rejected by clamd (wrong clamd version?)
%s: Failed to open file. ERROR
Could not connect to clamd on LocalSocket %s: %s
Could not connect to clamd on %s: %s
Filename cannot be NULL for MULTISCAN or CONTSCAN.
Cannot allocate a command buffer: %s
clamd replied "UNKNOWN COMMAND". Command was %s
%s: stat() failed with %s, clamd may not be responding
CCؑC** *1.4.6 /etc/freshclam.conf DatabaseDirectory %s/daily.cvd %s/daily.cld ClamAV %s/%u/%s /dev/null Can't open /dev/null
dup2(%d, %d) failed
ERROR: initgroups() failed.
log file '%s'.
Error was '%s'
ERROR: setgid(%d) failed.
ERROR: setuid(%d) failed.
sigaction %s/ Unable to allocate memory for db directory...
ERROR: This tool requires libclamav with functionality level %u or higher (current f-level: %u)
ERROR: --file-list: Can't open file %s
Can't get information about user %s.
ERROR: Can't get information about user %s.
ERROR: lchown to user '%s' failed on
lchown to user '%s' failed on log file '%s'. Error was '%s'
Virus database is older than %lld days!
ERROR: optaddarg: Unregistered option %s
ERROR: optaddarg: strdup() failed
ERROR: optaddarg: malloc() failed
ERROR: optparse: Can't register new option (not enough memory)
ERROR: optparse: longopts[] is too small
ERROR: optparse: shortopts[] is too small
ERROR: optparse: (short|long)opts[] is too small
ERROR: Please edit the example config file %s
ERROR: Missing argument for option at %s:%d
ERROR: Missing closing parenthesis in option %s at %s:%d
ERROR: Empty argument for option %s at %s:%d
ERROR: Incomplete option passed (missing argument)
ERROR: optparse: No corresponding long name for option '-%c'
ERROR: Parse error at %s:%d: Unknown option %s
WARNING: Ignoring unsupported option %s at %s:%d
WARNING: Ignoring unsupported option --%s (-%c)
WARNING: Ignoring unsupported option --%s
ERROR: Can't register argument for option %s
ERROR: Can't register argument for option --%s
WARNING: Ignoring deprecated option %s at %s:%d
WARNING: Ignoring deprecated option --%s (-%c)
WARNING: Ignoring deprecated option --%s
ERROR: optparse: Can't compile regular expression %s for option %s
ERROR: Incorrect argument format for option %s
ERROR: Incorrect argument format for option --%s (-%c)
ERROR: Incorrect argument format for option --%s
ERROR: Option --%s (-%c) requires a non-empty string argument
ERROR: Option --%s requires a non-empty string argument
ERROR: Can't parse numerical argument for option %s
ERROR: Can't parse numerical argument for option --%s (-%c)
ERROR: Can't parse numerical argument for option --%s
WARNING: Numerical value for option %s too high, resetting to %lld
WARNING: Numerical value for option --%s (-%c) too high, resetting to %lld
ERROR: optparse: calloc failed
ERROR: optparse: strdup failed
ERROR: Problem parsing options (name == NULL)
ERROR: Parse error: Unknown option %s
WARNING: Ignoring unsupported option %s
WARNING: Ignoring deprecated option %s
WARNING: Numerical value for option %s too high, resetting to 4G
Dump authenticode certificate chain. Perform HTML, script, and text normalization Always generate MDB entries for PE sections Maximum number of mismatched signatures when building a CVD. Zero disables this limit. Feature level to put in the CVD Version number of the CVD to build Create a hybrid (standard and bytecode) database file Force using the interpreter instead of the JIT Trust loaded bytecode (default yes) Load and print bytecode information without executing Print IR of bytecode signature Input file to run the bytecode n Don't show source line during tracing Number of entries the cache can store. Name of the analyzer as seen in prewikka Save all reports to a log file. By default the log file is locked for writing and only a single
daemon process can write to it. This option disables the lock. Maximum size of the log file.
Value of 0 disables the limit. Log all clean files.
Useful in debugging but drastically increases the log size. Use the system logger (can work together with LogFile). Type of syslog messages.
Please refer to 'man syslog' for the facility names. Rotate log file. Requires LogFileMaxSize option set prior to this option. Log additional information about the infected file, such as its
size and hash, together with the virus name. Save the process ID to a file. This option allows you to change the default temporary directory. This option allows you to change the default database directory.
If you enable it, please make sure it points to the same directory in
both clamd and freshclam. Only load the official signatures published by the ClamAV project. Return with a nonzero error code if the virus database is older than the specified number of days. By default, yara rules will be loaded. This option allows you to exclude yara rules when scanning and also to scan only using yara rules. Valid options are yes|no|only Path to a local socket file the daemon will listen on. Sets the group ownership on the unix socket. Sets the permissions on the unix socket to the specified mode. Remove a stale socket after unclean shutdown A TCP port number the daemon will listen on. By default clamd binds to INADDR_ANY.
This option allows you to restrict the TCP address and provide
some degree of protection from the outside world. Maximum length the queue of pending connections may grow to. Close the STREAM session when the data size limit is exceeded.
The value should match your MTA's limit for the maximum attachment size. The STREAM command uses an FTP-like protocol.
This option sets the lower boundary for the port range. This option sets the upper boundary for the port range. Maximum number of threads running at the same time. This option specifies the time (in seconds) after which clamd should
timeout if a client doesn't provide any data. This option specifies the time (in seconds) after which clamd should
timeout if a client doesn't provide any initial command after connecting. This option specifies how long to wait (in milliseconds) if the send buffer
is full. Keep this value low to prevent clamd hanging. Waiting for data from clamd will timeout after this time (seconds). Maximum number of queued items (including those being processed by MaxThreads
threads). It is recommended to have this value at least twice MaxThreads
if possible.
WARNING: you shouldn't increase this too much to avoid running out of file
descriptors, the following condition should hold:
MaxThreads*MaxRecursion + MaxQueue - MaxThreads + 6 < RLIMIT_NOFILE
(usual max for RLIMIT_NOFILE is 1024)
This option specifies how long (in seconds) the process should wait
for a new job. Don't scan files/directories whose names match the provided
regular expression. This option can be specified multiple times. Maximum depth the directories are scanned at. Follow symlinks to regular files. Scan files and directories on other filesystems. This option specifies the time intervals (in seconds) in which clamd
should perform a database check. Enable non-blocking (multi-threaded/concurrent) database reloads. This feature
will temporarily load a second scanning engine while scanning continues using
the first engine. Once loaded, the new engine takes over. The old engine is
removed as soon as all scans using the old engine have completed. This feature
requires more RAM, so this option is provided in case users are willing to
block scans during reload in exchange for lower RAM requirements. This option allows you to disable clamd's caching feature. Execute a command when virus is found.
Use the following environment variables to identify the file and virus names:
- $CLAM_VIRUSEVENT_FILENAME
- $CLAM_VIRUSEVENT_VIRUSNAME
In the command string, '%v' will also be replaced with the virus name.
Note: The '%f' filename format character has been disabled and will no longer
be replaced with the file name, due to command injection security concerns.
Use the 'CLAM_VIRUSEVENT_FILENAME' environment variable instead.
For the same reason, you should NOT use the environment variables in the
command directly, but should use it carefully from your executed script. Stop the daemon when libclamav reports an out of memory condition. Permit use of the ALLMATCHSCAN command. Enable debug messages in libclamav. Don't remove temporary files (for debugging purposes). Record metadata about the file being scanned.
Scan metadata is useful for file analysis purposes and for debugging scan behavior.
The JSON metadata will be printed after the scan is complete if Debug is enabled.
A metadata.json file will be written to the scan temp directory if LeaveTemporaryFiles is enabled. Run the daemon as a specified user (the process must be started by root). With this option enabled ClamAV will load bytecode from the database. It is highly recommended you keep this option on, otherwise you'll miss detections for many new viruses. Set bytecode security level.
Possible values:
TrustSigned - trust bytecode loaded from signed .c[lv]d files,
insert runtime safety checks for bytecode loaded from other sources
Paranoid - don't trust any bytecode, insert runtime checks for all
Recommended: TrustSigned, because bytecode in .cvd files already has these checks. Set bytecode timeout in milliseconds. Allow loading bytecode from outside digitally signed .c[lv]d files. ^(Auto|ForceJIT|ForceInterpreter|Test)$ Set bytecode execution mode.
Possible values:
Auto - automatically choose JIT if possible, fallback to interpreter
ForceJIT - always choose JIT, fail if not possible
ForceInterpreter - always choose interpreter
Test - run with both JIT and interpreter and compare results. Make all failures fatal. ^(none|None|bytecode|Bytecode|pcre|PCRE)$ Collect and print execution statistics.
Possible values:
Bytecode - reports bytecode statistics
PCRE - reports PCRE execution statistics
None - reports no statistics Detect Potentially Unwanted Applications. Exclude a specific PUA category. This directive can be used multiple times.
See https://docs.clamav.net/faq/faq-pua.html for the complete list of PUA
categories. Only include a specific PUA category. This directive can be used multiple
times. PE stands for Portable Executable - it's an executable file format used
in all 32- and 64-bit versions of Windows operating systems. This option
allows ClamAV to perform a deeper analysis of executable files and it's also
required for decompression of popular executable packers such as UPX or FSG.
If you turn off this option, the original files will still be scanned, but
without additional processing. Executable and Linking Format is a standard format for UN*X executables.
This option allows you to control the scanning of ELF files.
If you turn off this option, the original files will still be scanned, but
without additional processing. Enable the built in email scanner.
If you turn off this option, the original files will still be scanned, but
without parsing individual messages/attachments. Scan RFC1341 messages split over many emails. You will need to
periodically clean up $TemporaryDirectory/clamav-partial directory.
WARNING: This option may open your system to a DoS attack. Please don't use
this feature on highly loaded servers. With this option enabled ClamAV will try to detect phishing attempts by using
signatures. Scan URLs found in mails for phishing attempts using heuristics. In some cases (eg. complex malware, exploits in graphic files, and others),
ClamAV uses special algorithms to provide accurate detection. This option
controls the algorithmic detection. Allow heuristic match to take precedence.
When enabled, if a heuristic scan (such as phishingScan) detects
a possible virus/phish it will stop scan immediately. Recommended, saves CPU
scan-time.
When disabled, virus/phish detected by heuristic scans will be reported only
at the end of a scan. If an archive contains both a heuristically detected
virus/phish, and a real malware, the real malware will be reported.
Keep this disabled if you intend to handle "Heuristics.*" viruses
differently from "real" malware.
If a non-heuristically-detected virus (signature-based) is found first,
the scan is interrupted immediately, regardless of this config option. Enable the Data Loss Prevention module. This option sets the lowest number of Credit Card numbers found in a file
to generate a detect. This option sets the lowest number of Social Security Numbers found
in a file to generate a detect. With this option enabled the DLP module will search for valid
SSNs formatted as xxx-yy-zzzz. With this option enabled the DLP module will search for valid
SSNs formatted as xxxyyzzzz Perform HTML/JavaScript/ScriptEncoder normalisation and decryption.
If you turn off this option, the original files will still be scanned, but
without additional processing. This option enables scanning of OLE2 files, such as Microsoft Office
documents and .msi files.
If you turn off this option, the original files will still be scanned, but
without additional processing. With this option enabled clamav will try to detect broken executables
(PE, ELF, & Mach-O) and alert on them with a Broken.Executable heuristic signature. With this option enabled clamav will try to detect broken media files
(JPEG, TIFF, PNG, GIF) and alert on them with a Broken.Media heuristic signature. Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf). With this option enabled the DLP module will search for valid Credit Card
numbers only. Debit and Private Label cards will not be searched. Alert on encrypted archives (encrypted .zip, .7zip, .rar). Alert on encrypted documents (encrypted .pdf). With this option enabled OLE2 files with VBA macros, which were not
detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros". Alert on SSL mismatches in URLs, even if they're not in the database.
This feature can lead to false positives. Alert on cloaked URLs, even if they're not in the database.
This feature can lead to false positives. Alert on raw DMG image files containing partition intersections. This option enables scanning within PDF files.
If you turn off this option, the original files will still be scanned, but
without decoding and additional processing. This option enables scanning within SWF files.
If you turn off this option, the original files will still be scanned, but
without decoding and additional processing. This option enables scanning xml-based document files supported by libclamav.
If you turn off this option, the original files will still be scanned, but
without additional processing. This option enables scanning HWP3 files.
If you turn off this option, the original files will still be scanned, but
without additional processing. This option enables scanning OneNote files.
If you turn off this option, the original files will still be scanned, but
without additional processing. Scan within archives and compressed files.
If you turn off this option, the original files will still be scanned, but
without unpacking and additional processing. This option enables scanning of image (graphics).
If you turn off this option, the original files will still be scanned, but without additional processing. This option enables detection by calculating a fuzzy hash of image (graphics)
files
Signatures using image fuzzy hashes typically match files and documents by
identifying images embedded or attached to those files.
If you turn off this option, then some files may no longer be detected. This option causes memory or nested map scans to dump the content to disk.
If you turn on this option, more data is written to disk and is available
when the leave-temps option is enabled at the cost of more disk writes. This option sets the maximum amount of time a scan may take to complete.
The value of 0 disables the limit.
WARNING: disabling this limit or setting it too high may result allow scanning
of certain files to lock up the scanning process/threads resulting in a Denial of Service.
The value is in milliseconds. This option sets the maximum amount of data to be scanned for each input file.
Archives and other containers are recursively extracted and scanned up to this
value.
The value of 0 disables the limit.
WARNING: disabling this limit or setting it too high may result in severe
damage. Files/messages larger than this limit won't be scanned. Affects the input
file itself as well as files contained inside it (when the input file is
an archive, a document or some other kind of container).
The value of 0 disables the limit.
WARNING: disabling this limit or setting it too high may result in severe
damage to the system. Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
file, all files within it will also be scanned. This option specifies how
deeply the process should be continued.
The value of 0 disables the limit.
WARNING: disabling this limit or setting it too high may result in severe
damage to the system. Number of files to be scanned within an archive, a document, or any other
container file.
The value of 0 disables the limit.
WARNING: disabling this limit or setting it too high may result in severe
damage to the system. This option sets the maximum size of a file to check for embedded PE.
Files larger than this value will skip the additional analysis step.
Negative values are not allowed.
WARNING: setting this limit too high may result in severe damage or impact performance. This option sets the maximum size of a HTML file to normalize.
HTML files larger than this value will not be normalized or scanned.
Negative values are not allowed.
WARNING: setting this limit too high may result in severe damage or impact performance. This option sets the maximum size of a normalized HTML file to scan.
HTML files larger than this value after normalization will not be scanned.
Negative values are not allowed.
WARNING: setting this limit too high may result in severe damage or impact performance. This option sets the maximum size of a script file to normalize.
Script content larger than this value will not be normalized or scanned.
Negative values are not allowed.
WARNING: setting this limit too high may result in severe damage or impact performance. This option sets the maximum size of a ZIP file to reanalyze type recognition.
ZIP files larger than this value will skip the step to potentially reanalyze as PE.
Negative values are not allowed.
WARNING: setting this limit too high may result in severe damage or impact performance. This option sets the maximum number of partitions of a raw disk image to be scanned.
Raw disk images with more partitions than this value will have up to the value number partitions scanned.
Negative values are not allowed.
WARNING: setting this limit too high may result in severe damage or impact performance. This option sets the maximum number of icons within a PE to be scanned.
PE files with more icons than this value will have up to the value number icons scanned.
Negative values are not allowed.
WARNING: setting this limit too high may result in severe damage or impact performance. This option sets the maximum recursive calls to HWP3 parsing function.
HWP3 files using more than this limit will be terminated and alert the user.
Scans will be unable to scan any HWP3 attachments if the recursive limit is reached.
Negative values are not allowed.
WARNING: setting this limit too high may result in severe damage or impact performance. This option sets the maximum calls to the PCRE match function during an instance of regex matching.
Instances using more than this limit will be terminated and alert the user but the scan will continue.
For more information on match_limit, see the PCRE documentation.
Negative values are not allowed.
WARNING: setting this limit too high may severely impact performance. This option sets the maximum recursive calls to the PCRE match function during an instance of regex matching.
Instances using more than this limit will be terminated and alert the user but the scan will continue.
For more information on match_limit_recursion, see the PCRE documentation.
Negative values are not allowed and values > PCREMatchLimit are superfluous.
WARNING: setting this limit too high may severely impact performance. This option sets the maximum filesize for which PCRE subsigs will be executed.
Files exceeding this limit will not have PCRE subsigs executed unless a subsig is encompassed to a smaller buffer.
Negative values are not allowed.
Setting this value to zero disables the limit.
WARNING: setting this limit too high or disabling it may severely impact performance. This option specifies a directory or mount point which should be scanned on access. The mount point specified, or the mount point containing the specified directory will be watched, but only notifications will occur. If any directories are specified, this option will preempt the DDD system. It can also be used multiple times. This option specifies a directory (including all files and directories
inside it), which should be scanned on access. This option can
be used multiple times. This option allows excluding directories from on-access scanning. It can
be used multiple times. Only works with DDD system. Use this option to exclude the root UID (0) and allow any processes run under root to access all watched files without triggering scans. With this option you can exclude specific UIDs. Processes with these UIDs
will be able to access all files.
This option can be used multiple times (one per line). Using a value of 0 on any line will disable this option entirely. To exclude the root UID please enable the OnAccessExcludeRootUID option. This option allows exclusions via user names when using the on-access scanning client. It can
be used multiple times. Files larger than this value will not be scanned in on access. This option toggles the dynamic directory determination system for on-access scanning (Linux only). This option changes fanotify behavior to prevent access attempts on malicious files instead of simply notifying the user (On Access scan only). Enables extra scanning and notification after catching certain inotify events. Only works with the DDD system enabled. Max amount of time (in milliseconds) that the OnAccess client should spend for every connect, send, and receive attempt when communicating with clamd via curl (5s default) Max number of scanning threads to allocate to the OnAccess thread pool at startup--these threads are the ones responsible for creating a connection with the daemon and kicking off scanning after an event has been processed. To prevent clamonacc from consuming all clamd's resources keep this lower than clamd's max threads. Default is 5 Number of times the OnAccess client will retry a failed scan due to connection problems (or other issues). Defaults to no retries. When using prevention, if this option is turned on, any errors that occur during scanning will result in the event attempt being denied. This could potentially lead to unwanted system behaviour with certain configurations, so the client defaults to off and allowing access events in case of error. When started by root freshclam will drop privileges and switch to the user
defined in this option. This option defined how many times daily freshclam should check for
a database update. Use DNS to verify the virus database version. FreshClam uses DNS TXT records
to verify the versions of the database and software itself. With this
directive you can change the database verification domain.
WARNING: Please don't change it unless you're configuring freshclam to use
your own database verification domain. DatabaseMirror specifies to which mirror(s) freshclam should connect.
You should have at least one entry: database.clamav.net. This option allows you to easily point freshclam to private mirrors.
If PrivateMirror is set, freshclam does not attempt to use DNS
to determine whether its databases are out-of-date, instead it will
use the If-Modified-Since request or directly check the headers of the
remote database files. For each database, freshclam first attempts
to download the CLD file. If that fails, it tries to download the
CVD file. This option overrides DatabaseMirror, DNSDatabaseInfo
and Scripted Updates. It can be used multiple times to provide
fall-back mirrors. mirror1.mynetwork.com
mirror2.mynetwork.com This option defines how many attempts freshclam should make before giving up. With this option you can control scripted updates. It's highly recommended to keep them enabled. With this option enabled, freshclam will attempt to load new
databases into memory to make sure they are properly handled
by libclamav before replacing the old ones. Tip: This feature uses a lot of RAM. If your system has limited RAM and you are actively running ClamD or ClamScan during the update, then you may need to set `TestDatabases no`. By default freshclam will keep the local databases (.cld) uncompressed to
make their handling faster. With this option you can enable the compression.
The change will take effect with the next database update. Include an optional signature databases (opt-in). This option can be used multiple times. Exclude a standard signature database (opt-out). This option can be used multiple times. With this option you can provide custom sources (http:// or file://) for database files.
This option can be used multiple times. http://myserver.com/mysigs.ndb
file:///mnt/nfs/local.hdb If you're behind a proxy, please enter its address here. A user name for the HTTP proxy authentication. A password for the HTTP proxy authentication. If your servers are behind a firewall/proxy which does a User-Agent
filtering you can use this option to force the use of a different
User-Agent header. Send the RELOAD command to clamd after a successful update. Run a command after a successful database update. Use EXIT_1 to return 1 after successful database update. Run a command when a database update error occurs. Run a command when freshclam reports an outdated version.
In the command string %v will be replaced with the new version number. With this option you can provide a client address for the database downloading.
Useful for multi-homed systems. Timeout in seconds when connecting to database server. Timeout in seconds when reading from database server. 0 means no timeout. This option enables downloading of bytecode.cvd, which includes additional
detection mechanisms and improvements to the ClamAV engine. Disable authenticode certificate chain verification in PE files. Deprecated option to download signatures derived from the Google Safe Browsing API. See https://blog.clamav.net/2020/06/the-future-of-clamav-safebrowsing.html for more details. Deprecated option to set the max-scantime.
The value is in milliseconds. Deprecated option to alert on broken PE and ELF executable files. Deprecated option to enable heuristic alerts (e.g. "Heuristics.") PhishingAlwaysBlockSSLMismatch Deprecated option to alert on SSL mismatches in URLs, even if they're not in the database.
This feature can lead to false positives. Deprecated option to alert on cloaked URLs, even if they're not in the database.
This feature can lead to false positives. Deprecated option to alert on raw DMG image files containing partition intersections. Deprecated option to alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf). Initialize a supplementary group access (the process must be started by root). Define the clamd socket to connect to for scanning.
This option is mandatory! Syntax:
ClamdSocket unix:path
ClamdSocket tcp:host:port
The first syntax specifies a local unix socket (needs an absolute path) e.g.:
ClamdSocket unix:/run/clamav/clamd.sock
The second syntax specifies a tcp local or remote tcp socket: the
host can be a hostname or an ip address; the ":port" field is only required
for IPv6 addresses, otherwise it defaults to 3310
ClamdSocket tcp:192.168.0.1
This option can be repeated several times with different sockets or even
with the same socket: clamd servers will be selected in a round-robin fashion. Define the interface through which we communicate with sendmail.
This option is mandatory! Possible formats are:
[[unix|local]:]/path/to/file - to specify a unix domain socket;
inet:port@[hostname|ip-address] - to specify an ipv4 socket;
inet6:port@[hostname|ip-address] - to specify an ipv6 socket. /tmp/clamav-milter.sock
inet:7357 Define the group ownership for the (unix) milter socket. Sets the permissions on the (unix) milter socket to the specified mode. Messages originating from these hosts/networks will not be scanned
This option takes a host(name)/mask pair in CIRD notation and can be
repeated several times. If "/mask" is omitted, a host is assumed.
To specify a locally originated, non-smtp, email use the keyword "local". local
192.168.0.0/24
1111:2222:3333::/48 ^(Accept|Reject|Defer|Blackhole|Quarantine)$ Action to be performed on clean messages (mostly useful for testing).
The following actions are available:
Accept: the message is accepted for delivery
Reject: immediately refuse delivery (a 5xx error is returned to the peer)
Defer: return a temporary failure message (4xx) to the peer
Blackhole: like Accept but the message is sent to oblivion
Quarantine: like Accept but message is quarantined instead of being delivered Action to be performed on error conditions (this includes failure to
allocate data structures, no scanners available, network timeouts, unknown
scanner replies and the like.
The following actions are available:
Accept: the message is accepted for delivery;
Reject: immediately refuse delivery (a 5xx error is returned to the peer);
Defer: return a temporary failure message (4xx) to the peer. This option allows you to set a specific rejection reason for infected messages
and it's therefore only useful together with "OnInfected Reject"
The string "%v", if present, will be replaced with the virus name. If this option is set to "Replace" (or "Yes"), an "X-Virus-Scanned" and an
"X-Virus-Status" headers will be attached to each processed message, possibly
replacing existing headers.
If it is set to Add, the X-Virus headers are added possibly on top of the
existing ones.
Note that while "Replace" can potentially break DKIM signatures, "Add" may
confuse procmail and similar filters. When AddHeader is in use, this option allows you to set the reported
hostname. This may be desirable in order to avoid leaking internal names.
If unset the real machine name is used. Execute a command when an infected message is processed.
The following parameters are passed to the invoked program in this order:
virus name, queue id, sender, destination, subject, message id, message date.
Note #1: this requires MTA macroes to be available (see LogInfected below)
Note #2: the process is invoked in the context of clamav-milter
Note #3: clamav-milter will wait for the process to exit. Be quick or fork to
avoid unnecessary delays in email delivery /usr/local/bin/my_infected_message_handler Chroot to the specified directory.
Chrooting is performed just after reading the config file and before
dropping privileges. This option specifies a file which contains a list of basic POSIX regular
expressions. Addresses (sent to or from - see below) matching these regexes
will not be scanned. Optionally each line can start with the string "From:"
or "To:" (note: no whitespace after the colon) indicating if it is,
respectively, the sender or recipient that is to be allowed.
If the field is missing, "To:" is assumed.
Lines starting with #, : or ! are ignored. Messages from authenticated SMTP users matching this extended POSIX
regular expression (egrep-like) will not be scanned.
As an alternative, a file containing a plain (not regex) list of names (one
per line) can be specified using the prefix "file:".
e.g. SkipAuthenticated file:/etc/good_guys
Note: this is the AUTH login name! SkipAuthenticated ^(tom|dick|henry)$ This option allows you to tune what is logged when a message is infected.
Possible values are Off (the default - nothing is logged),
Basic (minimal info logged), Full (verbose info logged)
Note:
For this to work properly in sendmail, make sure the msg_id, mail_addr,
rcpt_addr and i macroes are available in eom. In other words add a line like:
Milter.macros.eom={msg_id}, {mail_addr}, {rcpt_addr}, i
to your .cf file. Alternatively use the macro:
define(`confMILTER_MACROS_EOM', `{msg_id}, {mail_addr}, {rcpt_addr}, i')
Postfix should be working fine with the default settings. This option allows you to tune what is logged when no threat is found in a scanned message.
See LogInfected for possible values and caveats.
Useful in debugging but drastically increases the log size. This option affects the behaviour of LogInfected, LogClean and VirusAction
when a message with multiple recipients is scanned:
If SupportMultipleRecipients is off (the default)
then one single log entry is generated for the message and, in case the
message is determined to be malicious, the command indicated by VirusAction
is executed just once. In both cases only the last recipient is reported.
If SupportMultipleRecipients is on:
then one line is logged for each recipient and the command indicated
by VirusAction is also executed once for each recipient.
Note: although it's probably a good idea to enable this option, the default value
is currently set to off for legacy reasons. Example ERROR: Unknown option passed
foo yes true ^(yes|true|1|no|false|0)$ /etc/clamd.d/scan.conf /etc/mail/clamav-milter.conf debug gen-json dumpcerts leave-temps no-warnings show-progress daemon no-dns list-mirrors update-db database /var/lib/clamav recursive gen-mdb follow-dir-symlinks ^[0-9]+$ follow-file-symlinks bell suppress-ok-results exclude exclude-dir include include-dir structured-ssn-format hex-dump md5 sha1 sha256 imp fuzzy-img print-certs html-normalise ascii-normalise utf16-decode build max-bad-sigs 3000 flevel cvd-version no-cdiff server unpack unpack-current info list-sigs find-sigs decode-sigs test-sigs vba vba-hex compare run-cdiff verify-cdiff hybrid defaultcolors config-dir /etc non-default generate-config force-interpreter trust-bytecode printsrc Print source code of bytecode printbcir input trace bytecode trace level no-trace-showsource archive-verbose bytecode-trust-all http-proxy proxy-user log-verbose force disable-summary disable-archive no-archive no-pe no-elf no-ole2 no-pdf no-html no-mail no-phishing-sigs no-phishing-scan-urls no-algorithmic no-phishing-restrictedscan max-ratio max-space ^[0-9]+[KMG]?$ unzip unrar arj unzoo lha jar tar tgz deb AlertExceedsMax alert-exceeds-max CacheSize cache-size 65536 PreludeEnable prelude-enable Enable prelude PreludeAnalyzerName prelude-analyzer-name /tmp/clamav.log LogFileUnlock LogFileMaxSize 5M LogTime Log time with each message. LogClean LogSyslog LogFacility LOG_LOCAL6 LOG_MAIL LogVerbose Enable verbose logging. LogRotate log-rotate ExtendedDetectionInfo PidFile /run/clamav/clam.pid TemporaryDirectory tempdir /tmp datadir OfficialDatabaseOnly official-db-only no FailIfCvdOlderThan fail-if-cvd-older-than -1 YaraRules yara-rules /run/clamav/clamd.sock LocalSocketGroup virusgroup LocalSocketMode 660 FixStaleSocket 3310 localhost MaxConnectionQueueLength 30 100M StreamMinPort 1024 StreamMaxPort 2048 120 CommandReadTimeout SendBufTimeout 200 300 MaxQueue IdleTimeout ^/proc/
^/sys/ max-dir-recursion 15 Follow directory symlinks. cross-fs SelfCheck 600 ConcurrentDatabaseReload DisableCache disable-cache VirusEvent /opt/send_virus_alert_sms.sh ExitOnOOM AllowAllMatchScan Foreground foreground Don't fork into background. Debug LeaveTemporaryFiles GenerateMetadataJson User Bytecode BytecodeSecurity ^(TrustSigned|Paranoid)$ TrustSigned BytecodeTimeout bytecode-timeout 10000 BytecodeUnsigned bytecode-unsigned BytecodeMode bytecode-mode Auto Statistics statistics None DetectPUA detect-pua ExcludePUA exclude-pua NetTool
PWTool IncludePUA include-pua Spy
Scanner
RAT ScanPE scan-pe ScanELF scan-elf ScanMail scan-mail ScanPartialMessages PhishingSignatures PhishingScanURLs HeuristicAlerts heuristic-alerts HeuristicScanPrecedence heuristic-scan-precedence StructuredDataDetection detect-structured StructuredMinCreditCardCount structured-cc-count StructuredMinSSNCount structured-ssn-count StructuredSSNFormatNormal StructuredSSNFormatStripped ScanHTML scan-html ScanOLE2 scan-ole2 AlertBrokenExecutables alert-broken AlertBrokenMedia alert-broken-media AlertEncrypted alert-encrypted StructuredCCOnly structured-cc-mode AlertEncryptedArchive alert-encrypted-archive AlertEncryptedDoc alert-encrypted-doc AlertOLE2Macros alert-macros AlertPhishingSSLMismatch alert-phishing-ssl AlertPhishingCloak alert-phishing-cloak AlertPartitionIntersection alert-partition-intersection ScanPDF scan-pdf ScanSWF scan-swf ScanXMLDOCS scan-xmldocs ScanHWP3 scan-hwp3 ScanOneNote scan-onenote ScanArchive scan-archive ScanImage scan-image ScanImageFuzzyHash scan-image-fuzzy-hash ForceToDisk force-to-disk MaxScanTime max-scantime 120000 max-scansize 400M max-recursion 17 max-files MaxEmbeddedPE max-embeddedpe 40M MaxHTMLNormalize max-htmlnormalize MaxHTMLNoTags max-htmlnotags 8M MaxScriptNormalize max-scriptnormalize 20M MaxZipTypeRcg max-ziptypercg 1M MaxPartitions max-partitions 128 MaxIconsPE max-iconspe 100 MaxRecHWP3 max-rechwp3 16 PCREMatchLimit pcre-match-limit 100000 PCRERecMatchLimit pcre-recmatch-limit 5000 PCREMaxFileSize pcre-max-filesize OnAccessMountPath /
/home/user OnAccessIncludePath /home
/students OnAccessExcludePath /home/bofh
/root OnAccessExcludeRootUID OnAccessExcludeUID OnAccessExcludeUname clamuser OnAccessMaxFileSize OnAccessDisableDDD OnAccessPrevention OnAccessExtraScanning OnAccessCurlTimeout 10000L OnAccessMaxThreads OnAccessRetryAttempts OnAccessDenyOnError watch-list exclude-list DevACOnly dev-ac-only DevACDepth dev-ac-depth DevPerformance dev-performance DevLiblog dev-liblog UpdateLogFile /var/log/freshclam.log DatabaseOwner clamupdate Checks checks DNSDatabaseInfo current.cvd.clamav.net DatabaseMirror database.clamav.net PrivateMirror MaxAttempts ScriptedUpdates TestDatabases CompressLocalDatabase ExtraDatabase dbname1
dbname2 ExcludeDatabase DatabaseCustomURL HTTPProxyServer your-proxy HTTPProxyPort HTTP proxy's port 8080 HTTPProxyUsername username HTTPProxyPassword HTTPUserAgent NotifyClamd daemon-notify OnUpdateExecute on-update-execute command OnErrorExecute on-error-execute OnOutdatedExecute on-outdated-execute LocalIPAddress local-address aaa.bbb.ccc.ddd ConnectTimeout ReceiveTimeout DisableCertCheck nocerts SafeBrowsing TimeLimit timelimit DetectBrokenExecutables detect-broken AlgorithmicDetection algorithmic-detection block-max PhishingAlwaysBlockCloak OLE2BlockMacros block-macros ArchiveBlockEncrypted block-encrypted MailMaxRecursion ArchiveMaxScanSize ArchiveMaxRecursion ArchiveMaxFiles ArchiveMaxCompressionRatio ArchiveBlockMax ArchiveLimitMemoryUsage MailFollowURLs mail-follow-urls AllowSupplementaryGroups ScanOnAccess ClamdSocket tcp:scanner.mydomain:7357 MilterSocket MilterSocketGroup MilterSocketMode LocalNet OnClean Accept OnInfected Quarantine OnFail ^(Accept|Reject|Defer)$ Defer RejectMsg MTA specific AddHeader ^(No|Replace|Yes|Add)$ Replace ReportHostname my.mail.server.name VirusAction Chroot /newroot AllowList /etc/allowed_addresses Whitelist SkipAuthenticated LogInfected Basic SupportMultipleRecipients c"!!O! O!ERROR: %s WARNING: %s Log size = %lld, max = %lld
-%Y%m%d_%H%M%S.log %s -> %s -> %s LOG_AUTH LOG_AUTHPRIV LOG_CRON LOG_DAEMON LOG_FTP LOG_KERN LOG_LPR LOG_NEWS LOG_SYSLOG LOG_USER LOG_UUCP LOG_LOCAL0 LOG_LOCAL1 LOG_LOCAL2 LOG_LOCAL3 LOG_LOCAL4 LOG_LOCAL5 LOG_LOCAL7 WARNING: Log size limit met but log file rotation turned off. Forcing log file rotation anyways.
Need to rotate log file due to size but ran out of memory.
Need to rotate log file due to size but could not get local time.
ERROR: Failed to open log file %s: %s
ERROR: Failed to convert the open log file descriptor for %s to a FILE* handle: %s
WARNING: File locking not supported (NFS?) ERROR: Failed to lock the log file %s: %s
POSIXLY_CORRECT %s: illegal option -- %c
%s: unrecognized option `%s'
%s: option `%s' is ambiguous
%s: option requires an argument -- %c
%s: option `--%s' doesn't allow an argument
%s: option `--%s' requires an argument
;4 e ~h pP ` ` \ < Рt $ px P p Pl p0 l p ( @D \ ` н
p
P$ | 0 l (
0 P @4 0 h | 0 `, l < 0 0 @ L l @ p p pP d 0 T ` P $ P%< p) 3 4 @8x ? ? ? ?P ?h zR x / D $ 4 z FJ w ?:*3$" \ X t EAR H FMN A(GeFBDJFA H H BEE B(D0I8DP
8D0A(B BBBC H ( BIB B(A0A8D[
8A0A(B BBBF P t @ FBB B(A0A8G L){
8A0A(B BBBJ < FBA A(G L(
(A ABBE 4 | FAA G L(
AABF @ T FEB L(A0A8JQNDC
8A0A(B BBBF ITB/XKA ( AAJ
AAD P BBB B(A0A8G L)
8A0A(B BBBD 0 D BDD G[
AABH x \ FBE B(D0C8G
8A0A(B BBBE wGLA H X FBB E(A0D8J
8A0A(B BBBF $ 8 ܫe AAD \AAH ` $* FBE E(D0D8G
8A0A(B BBBJ L } FEE E(D0D8J
8A0A(B BBBF 8 8E BEE D(C0j(A BBB 4 8 LB BED C(D0g(C ABB p d EW
D N
R ( 7 BDD iAB $A eQ \ GR
G а9 AU
J 1 \T ( AG
AD T L ر BBB B(D0A8DPXM`jXAP
8A0A(B BBBA 4 @ BAA G I W
AABA BBE H(C0
(D EBBL Q
(C BBBF F
(C BBBA C
(C BBBD F
(C BBBA ( d д@ YAG Q
AAD 0 W AAD n
FAE OFA ( 7 BDC jAB T $4 BBB B(A0A8H Q
DV
8A0A(B BBBI ( H 7 BDD iAB 4 t N BED D(D0r(C ABB L 8 BBA A(D0Q
(A ABBG N
(A ABBD 8 BED A(Gy
(A ABBF \ 8 L BJB B(A0A8GJcA
8A0A(B BBBG X
FBA A(D0`
(A ABBD h
(I HDBI t(M CBBT BBB B(A0A8G L@LB*
8A0A(B BBBA \ L
( FBB B(A0A8G MiA
8A0A(B BBBJ 8
FBA A(DP
(A ABBH x
FBB B(A0A8DPGXH`ZXAPQXG`kXAPU
8A0A(B BBBA w
8F0A(B BBBJ d `B x Q Jj
L P 8 U BBA A(G@
(A ABBG \ FDD A(D0r
(C ABBC D
(F CBBG V
(C ABBJ 0 ` FHA J
AABF H P FEE D(D0\
(F BBBH A(C BBBP BBB B(A0A8G L@LB
8A0A(B BBBE 4
# H H
, FBB E(D0D8D@
8D0A(B BBBJ 4
} JAF H
ABD YAB (
(( EAGc
AAF <
,l KCC jABBP XAB 8 \ L X T ` T KDD C(L0n(C ABBHP0Y(C ABB L FIB B(A0A8G\
8A0A(B BBBF P <{ FBB B(A0A8G L*
8A0A(B BBBH \ h EAF x l l hh FBB B(A0A8D@IHFP[HA@|
8D0A(B BBBJ ,
8D0A(B BBBG X h= FBB A(D0D@
0D(A BBBF D
0A(A BBBD X LV HT
D s D x LAA k
ABD
ABG R
ABK @ FKB A(A0DP
0A(A BBBA l! EN
E H 8 |0 HM
K T EO 8 p " FBD A(G0T
(A ABBB 0 FDD GC
AABD 8 T FJG D(G
(A ABBI
0 0 FHA Gn
AABH , d EDD0A
AAH $ T AAG EDA` 8 BEE J(D0D8DP
8A0A(B BBBH L
8C0A(B BBBA L d BED D(D0g
(A ABBH
(C ABBA $ p T EAG ADA, ODA ABA ` FBB B(A0A8G L0 0D0P0A0
8A0A(B BBBA \ , h FBE B(D0C8F`DFB
8A0A(B BBBA L FBB B(A0D8G
8A0A(B BBBK ( _ EAD }
DAL H
FBB B(D0D8G
8A0A(B BBBI L T
FBB E(A0A8I
E
8A0A(B BBBG 4 b FKC s
IBF AFB d 8 FBB E(K0D8D@
8A0A(B BBBB L
8F0A(B BBBE d D BBB L(D0D8G
8C0A(B BBBF
8J0A(B BBBE % % D %e FEE E(H0H8G@n8A0A(B BBB 8% 4 0% I" h h
r
r
h c
r
r
h r
r
h c
r
r
V
r
r
+ r
r
) r
r
v
: r
r
r
h
: r
r
( r
r
r
r
r
r
h
: r
r
+ d
r
r
2
r
r
9
r
r
F r
r
h
r
r
w m
r
r
$w
r
r
v
r
r
w z
r
r
r
P d Y r
r
i r
r
r
s
H r
{ r
r
r
r
r
r
h
r
r
v f r
r
h i
r
r
h p r
r
h w
r
r
o
r
r
w r
r
w r
r
w
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
w
r
r
r
r
!
r
r
+ r
r
7 r
r
F r
r
V r
r
c b r
r
i x v { Д r
r
r
r
r
r
r
r
u r
r
r
r
i r
r
l Y r
r
f Y r
r
r
r
r
r
r
r
r
r
d r
r
c r
r
r r
r
r
r
r
d
r
r
# c . @ r
r
3 n
@ r
r
? g @ r
r
O f
P r
a t
r
i
r
p p
y r
c
r
r r
T r
s
( r
a
r
r
t
r
r
r
r
r
r
r
r
r
r
!
r
r
1
r
r
A
r
r
L
r
r
R
r
r
Y
r
r
a
r
r
h
r
r
p
r
r
x
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
&
r
r
8 B P M S a
p r
x r
J% l
Ȗ
H
' 0
;
S ]
h
h
~ p ( - H Y # Y
8 #
v . E ț V a q u
8
v h v 0 Aw @ p ` `
x О H ؟ x ` d 8 r +w , > Qw
A iw
@ |w \
h
e X o s
إ
Ȩ
F
#
7
P L b Q
ت
Z k ' ج
H p Ю
x
* 5 A P [ P g w ~
@
0
г {
ȴ
(
p
0
5 M
ȸ _ | ? P ?
x
(
.
; L
_ n
0 ~
P
,
r
? R
g
0
8
h
)
4 G
] i
w " 0 @
" X " ' % ( ; @ O S a p s 2 d + @ = O \ ` p
@ P
`
'
= h Q X k p %
W r
r
e r
r
r
r
r
r
r
r
r
r
J% l 4
u B ( B M T c [ k k ( ?
P
r
P ! 8 3 x C N \ n s &w 7
! h ! $! 8! G! a ( U! e! t! < r Q
! !
!
! ! ! !
! !
@ " "
r
r
2
" X
8 l
1" A"
N" d"
t" r
r
" r
r
" r
r
" r
r
" r
r
"
r
r
"
r
r
" #
r
r
#
x 8#
r
r
E# Q# k# @ p x# V # q # 8 # h # # # h # # # # # @ # # # $ $ &$ .$ ( =$ Q$ ]$ d$ m$ h w$ $ h w$ $ ( x $ $ $ $
N"
r
r
r
r
r
r
!
r
r
#
r
r
v r
r
"
r
r
" r
r
" r
r
" r
r
r
r
r
r
r
r
r
r
r
r
w
r
r
Aw r
r
v r
r
v r
r
r
r
^% g% P t% H }% % X % % 0 ' % 8 ^% % ( % % @ % % % % % % &
h H" H" o 0 x p
" P o o o o o k " 0 @ P ` p Ч 0 @ P ` p Ш 0 @ P ` p Щ 0 @ P ` p Ъ 0 @ P ` p Ы 0 @ P ` p Ь 0 @ P ` p Э 0 @ P ` p `I" d GA$3a1 o GA$3p1113 h GA* GA$annobin gcc 8.5.0 20210514 GA$plugin name: gcc-annobin GA$running gcc 8.5.0 20210514 GA* GA!
GA*FORTIFY GA+GLIBCXX_ASSERTIONS GA*cf_protection GA+omit_frame_pointer GA+stack_clash GA!stack_realign GA*GOW * g GA* = GA$3a1 p h GA$3p1113 0 eh GA* GA$annobin gcc 8.5.0 20210514 GA$plugin name: gcc-annobin GA$running gcc 8.5.0 20210514 GA* GA!
GA*FORTIFY GA+GLIBCXX_ASSERTIONS GA*cf_protection GA+omit_frame_pointer GA+stack_clash GA!stack_realign GA*GOW * 0 \ GA* 0 T GA* @ h GA* eh GA*GOW * g eh GA*GOW * ph h
GA*FORTIFY 0 h GA+GLIBCXX_ASSERTIONS
GA*FORTIFY @ eh GA+GLIBCXX_ASSERTIONS clamdscan-1.4.6-1.el8.x86_64.debug i =7zXZ ִF ! t/ `] ?Eh=ڊ2N:mwwh.KΧ+C3Ҥ2I :=Ů01YX%a{Ona q4k,(¯uKĜN/џS!P; 8"/Wڽc( 3tLv%)RfKgmNOЂLT_9 'a*2/Q ~UymT9PU}S?}˖o+ xx8<$BI ǥ'pD;q5QELhM~ׄ2t*ZZj)
8߈c[ԉd dKKJo^ugH-1j냁h!ː
]rpQ f1.{ ^z#xDmÿ: *^Pgx@I$ ?
Crt0.gXjT#gVe t :tNr?T{4.zw̮ wM9AFl- t ʾ~և8=LB8( 6+ڛ^X<9mx. A:Bg~gV4\fD2l>u̾xU]t .Йofi`b.Q*
ҍ#IMKX6nLjEpDBgh`v ?kd
-m=ǃ_){i$I:6kR#A>s`Ŏ^7S ><\qz #ק|5= `b`j4ަϘ{f:d75)B^pzĢW -9E+""0҆"tRS[rZ-,p5A$6d$Āp.K58JTqo&%+ &e`7de/ ekfjvT_[bҨOX4}u \GrIQy| "L*ċ('N?ZPHMEP\jP07ݾ(۶s!Iy&:`a W\Q`n }sw&-k ᪀cclJ;p yʼ\]nx
a\k2APߴ $ A&\;|8M[u );Q[9z^.gNOdg7RO?5JYw틕a +;s,J=<5w<8cD' !FysU}&HգbJrdFjW5 .O~]( $#rpg@%F?fiO{R ߯* 9l<29ydkRk)UiTO<ҕud0Aِج c@ C߁u܊vFORκ=%qÓ'F, ٶ2 ;Q 8Jy==NM5Hp1lXF&ZJ7
9StEbM PRg YZ .shstrtab .interp .note.gnu.property .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .data.rel.ro .dynamic .got .data .bss .gnu.build.attributes .gnu_debuglink .gnu_debugdata & 4 $ G o 0 0 @ Q p p
Y x x a o n o } P P B h h
h h 0 ( ( 4 , , H H" H H" H I" I ` " " 8 " "
b h ( / P >