clamscan(1)

NAME

clamscan - scan files and directories against viruses

SYNOPSIS

clamscan [options] [file/directory/-]

DESCRIPTION

clamscan is a command line anti-virus scanner. It's a part of the Clam AntiVirus package.

OPTIONS

-h, --help
    Print help information and exit.

-V, --version
    Print version number and exit.

-v, --verbose
    Be verbose.

--debug
    Enable debug messages (from libclamav).

--quiet
    Be quiet (only print error messages).

--stdout
    Write all messages to the standard output (stdout) instead of the standard error output (stderr).

-d FILE/DIR, --database=FILE/DIR
    Load virus database from FILE or load all virus database files from DIR.

-l FILE, --log=FILE
    Save scan report to FILE.

--tempdir=DIRECTORY
    Create temporary files in DIRECTORY. Directory must be writeable for the 'clamav' user or unprivileged user running clamscan.

-r, --recursive
    Scan directories recursively. All the subdirectories in the given directory will be scanned.

--bell
    Sound bell on virus detection.

--no-summary
    Disable summary printing at the end of scanning.

--exclude=PATT
    Don't scan file names containing PATT. It may be used multiple times.

--include=PATT
    Only scan file names containing PATT. It may be used multiple times.

--mbox
    Enable scanning of various mail file types (also treat stdin as a mailbox - for backward compatibility).

-i, --infected
    Only print infected files.

--remove
    Remove infected files. Be careful.

--move=DIRECTORY
    Move infected files into DIRECTORY. Directory must be writeable for the 'clamav' user or unprivileged user running clamscan.

EXTRACTION OPTIONS:

--no-ole2
    Disable support for Microsoft Office document files.

--no-archive
    Disable archive support built in libclamav.

--block-encrypted
    Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).

--max-files=#n
    Extract first #n files from each archive. This option protects your system against DoS attacks (default: 500)

--max-space=#n
    Extract first #n kilobytes from each archive. You may give the number in megabytes in format xM or xm, where x is a number. This option protects your system against DoS attacks (default: 10 MB)

--max-recursion=#n
    Set archive recursion level limit. This option protects your system against DoS attacks (default: 5).

--max-ratio=#n
    Set maximum archive compression ratio limit. This option protects your system against DoS attacks (default: 200).

--unzip[=FULLPATH]
    In most cases you don't need this option - the built-in unarchiver will do extract Zip archives. This option however may be used as a backup for internal unpacker - see the full documentation for more information. When enabled without an argument, unzip program will be searched in $PATH. If unzip cannot be found in $PATH, you must force it with =pathname. Remember about '=' between the option and an argument.

--unrar[=FULLPATH]
    Scan .rar files.

--unarj[=FULLPATH]
    Scan .arj files.

--unzoo[=FULLPATH]
    Scan .zoo files.

--lha[=FULLPATH]
    Scan .lzh files.

--jar[=FULLPATH]
    clamscan uses unzip for .jar files, so optionally eventually you will need to pass a full path to unzip.

--deb[=FULLPATH]
    This option supports debian binary packages. Implies --tgz, but doesn't conflict with --tgz=FULLPATH. It requires ar utility.

--tar[=FULLPATH]
    This option supports non-compressed archives.

--tgz[=FULLPATH]
    This option supports tar.gz and .tgz files. You need GNU tar, on non-Linux system you probably have it installed as gtar. If it's in $PATH, please use --tgz=gtar in other case please pass a full path.

EXAMPLES

(0) Scan selected file:
    clamscan file

(1) Scan current working directory:
    clamscan

(2) Scan all files (and subdirectories) in /home:
    clamscan -r /home

(3) Load database from selected file and limit disk usage to 50 Mb:
    clamscan -d /tmp/newclamdb --max-space=50m -r /tmp

(4) Scan data stream:
    cat testfile | clamscan -

(5) Scan mail spool directory:
    clamscan -r --mbox /var/spool/mail

RETURN CODES

Note: some return codes may only appear in a one file mode (clamscan is started with file argument). Those are marked with (ofm). 0 : No virus found.

1 : Virus(es) found.

40: Unknown option passed.

50: Database initialization error.

52: Not supported file type.

53: Can't open directory.

54: Can't open file. (ofm)

55: Error reading file. (ofm)

56: Can't stat input file / directory.

57: Can't get absolute path name of current working directory.

58: I/O error, please check your filesystem.

59: Can't get information about current user from /etc/passwd.

60: Can't get information about user 'clamav' (default name) from /etc/passwd.

61: Can't fork.

63: Can't create temporary files/directories (check permissions).

64: Can't write to temporary directory (please specify another one).

70: Can't allocate and clear memory (calloc).

71: Can't allocate memory (malloc).

CREDITS
Please check the full documentation for credits.

AUTHOR

Tomasz Kojm <tkojm@clamav.net>

SEE ALSO

clamdscan(1), freshclam(1)