clamscan(1)

NAME

clamscan - scan files/directories against viruses

SYNOPSIS

clamscan [options] [file/directory/-]

DESCRIPTION

clamscan is a console anti-virus scanner. It's a part of the Clam AntiVirus package.

OPTIONS

-h, --help
    Output help information and exit.

-V, --version
    Print the version number and exit.

-v, --verbose
    Be verbose. This option causes clamscan to print many additional informations.

--quiet
    Be quiet - output only error messages.

--stdout
    Write all messages to the standard output (stdout), instead of the standard error output (stderr). The buffer is automatically flushed (stdout unlike stderr is buffered), to avoid a race conditions on output.

-d FILE/DIR, --database=FILE/DIR
    Load the virus database from FILE or load all .db and .db2 files from DIR.

-l FILE, --log=FILE
    Save the scan report to FILE. By default the log isn't saved.

--log-verbose
    Save an additional information (mostly needless) to the report file.

--tempdir=DIRECTORY
    Create temporary files in DIRECTORY.Directory must be writeable for the 'clamav' user or unprivileged user running clamscan.

-r, --recursive
    Scan directories recursively. All the files in the given directory will be scanned. This option affects on scanning subdirectories in archives, if you are using unpackers just turn it on.

--disable-summary
    Disable summary printing at the end of the scanning.

--exclude=PATT
    Don't scan file names containing PATT. It may be used multiple times.

--include=PATT
    Only scan file names containing PATT. It may be used multiple times.

--mbox
    Treat stdin as a mailbox (attachement scanning).

--threads=#n
    Activate the threads mechanism. Threads may improve the performance on multiprocessors machines. This implementation uses POSIX threads. n threads will be started. On Linux SMP systems the threads will be configured automatically, so if you don't want to use them, set n to 0. Please notice, that main thread is not counted. #n represents number of threads-scanners, it should be equal to number of CPUs in your system.

-i, --infected
    Print infected files only.

--remove
    Remove infected files. Be careful.

--force
    With this option you may ignore some errors. Be careful.

EXTRACTION OPTIONS:

--disable-archive
    Disable archive support built in libclamav.

--max-files=#n
    Extract first #n files from each archive. This option should be used to protect your system against DoS attacks. Note: always few files more are extracted due to the limit implementation (expecially when archive contains small files). All file types are counted.

--max-space=#n
    Extract first #n kilobytes from each archive. You may give the number in megabytes in format xM or xm, where x is a number.

--max-recursion=#n
    Set the archive recursion level.

--unzip[=FULLPATH]
    With this option all zipped files are scanned. If you turn on this option without the argument, unzip program will be searched in $PATH. If unzip is outside $PATH, please supply it with =pathname. Remember about '=' between option and argument. (This is needed due to the implementation of getopt_long() and optional arguments to long options).

--unrar[=FULLPATH]
    Supports .rar files.

--unace[=FULLPATH]
    Supports .ace files.

--unarj[=FULLPATH]
    Supports .arj files.

--zoo[=FULLPATH]
    Supports .zoo files.

--lha[=FULLPATH]
    Supports .lzh files.

--jar[=FULLPATH]
    clamscan uses unzip for .jar files, so optionally give a full path to unzip.

--deb[=FULLPATH]
    This option supports debian binary packages. Implies --tgz, but doesn't conflict with --tgz=FULLPATH. It requires ar utility.

--tar[=FULLPATH]
    This option supports non-compressed archives.

--tgz[=FULLPATH]
    This option supports tar.gz and .tgz files. You need GNU tar, on non-Linux system you probably have it as gtar. If it's in $PATH, please use --tgz=gtar in other case please use a full pathname.

EXAMPLES

(0) To scan one file:
    clamscan file

(1) To scan current directory:
    clamscan

(2) To scan all files in /home:
    clamscan -r /home

(3) Load the database from another file and use 2 threads to scan recursively /tmp:
    clamscan -d /tmp/newclamdb --threads=2 -r /tmp

(4) Scan a data stream:
    cat testfile | clamscan -

(5) Scan a mbox file:
    cat /var/spool/mail/zolw | clamscan --mbox -

RETURN CODES

Note: some return codes may appear only in a one file mode (clamscan is started with file argument). These one are marked with (ofm). 0 : No virus found.

1 : Virus(es) found.

40: Unknown option passed.

50: The database can't be initialized.

51: Wrong number of threads given.

52: Not supported file type.

53: Can't open directory.

54: Can't open file. (ofm)

55: Error reading file. (ofm)

56: Can't stat input file / directory.

57: Can't get absolute pathname of current working directory.

58: I/O error, check your filesystem.

59: Can't get information about current user from /etc/passwd.

60: Can't get information about user 'clamav' (default name) from /etc/passwd.

61: Can't fork.

63: Can't create temporary files/directories (check permissions).

64: Can't write to temporary directory, please specify another one.

70: Can't allocate and clear memory (calloc).

71: Can't allocate memory (malloc).

CREDITS
Please check the full documentation for credits.

AUTHOR

Tomasz Kojm <zolw@konarski.edu.pl>

SEE ALSO

clamd(8), freshclam(1), sigtool(1), clamav.conf(5)