You can view the documentation below, or browse our GitHub Repository, where you can contribute to user manual and FAQ.
General | Installing ClamAV | How to Report A Bug | Miscellaneous FAQ | ClamAV Virus Database FAQ | End of Life Policy (EOL) | Potentially Unwanted Applications (PUA) | Mailing Lists FAQ | Troubleshooting FAQ | Safebrowsing | Upgrading ClamAV | ClamAV on Microsoft Windows FAQ | Which Version of ClamAV should I use? | Uninstalling ClamAV | ClamAV Overview | Interpreting Scan Alerts FAQ | Freshclam FAQ | How do I ignore a ClamAV signature?
Manual | Clam AntiVirus User Manual
Manual | UserManual | Installing ClamAV on Unix / Linux / macOS from Source | Installing ClamAV on Windows | Introduction | LibClamAV | On-Access Scanning | Creating signatures for ClamAV | Usage | ClamAV Development
Manual | UserManual | Installation-Unix | Installation on Debian and Ubuntu Linux Distributions | Installation on macOS (Mac OS X) | Installation on Redhat and CentOS Linux Distributions
Manual | UserManual | Signatures | Trusted and Revoked Certificates | Body-based Signature Content Format | Bytecode Signatures | Signatures based on container metadata | Database Info | Dynamic Configuration (DCONF) | Passwords for archive files \[experimental\] | Extended signature format | File Type Magic | ClamAV File Types | Functionality Levels (FLEVELs) | File hash signatures | Logical signatures | PhishSigs | Using YARA rules in ClamAV | Allow list databases
Manual | UserManual | Usage | Configuration | Scanning | Signature Testing and Management
Additional | Microsoft Authenticode Signature Verification | Private Local Mirrors
The Functionality Level (or FLEVEL) is an integer that signatures may use to define which versions of ClamAV the signature features support. It is up to the signature writers to select the correct FLEVEL or range of FLEVELs when writing a signature so that it does not cause failures in older versions of ClamAV.
Setting appropriate FLEVELs in signatures is particularly crucial when using features added in the last 3-4 major release versions.
The following is an abridged list of FLEVELS for each version. Only major versions and FLEVELs relevant to new/changed/fixed signature features are listed.
| flevel | version | release | new signature features | |--------|---------|---------|------------------------------------------------------------------------| | 41 | 0.95.0 | 3/2009 | Ignores use ign format (including line number). | | 51 | 0.96.0 | 3/2010 | Bytecode & CDB sigs. Start using ign2. | | 56 | 0.96.4 | 10/2010 | Min level for bytecode sigs. | | 60 | 0.97.0 | 2/2011 | | | 74 | 0.98.0 | 9/2013 | ISO9660 scanning support. All-match feature. | | | | | Wild card bracket notation{} for body-based signatures. | | | | | "SE" offset modifier. | | | | | Target types 10 - 13: (PDF, (SWF) Flash, Java, Internal). | | 76 | 0.98.1 | 1/2014 | XZ support and ForceToDisk scan option. | | | | | Libxml2, XAR, DMG, HFS+/HFSX. | | | | | FTM type 4 (in-buffer partition magic, analogous to type 0 for files). | | 79 | 0.98.5 | 11/2014 | File properties (preclass). Target type 13: for preclass feature. | | 81 | 0.99.0 | 11/2015 | Yara and PCRE support. Target type 14: non-listed types ("other"). | | 82 | 0.99.1 | 2/2016 | Hangul Word Processor (HWP) type file parser. | | 90 | 0.100 | 4/2018 | "Intermediates" logical sig expression option. | | | | | MHTML and PostScript types. | | | | | Substring wildcard (*) fix: order matters, substrings can't overlap. | | 100 | 0.101 | 12/2018 | "Byte-Compare" Logical subsignature. Windows Shortcut (LNK) type. | | 110 | 0.102 | 10/2019 | "Adds BC_ELF_UNPACKER, BC_MACHO_UNPACKER. CL_TYPE_EGG (egg archive). |
For more inforamtion on ClamAV file type support, see the File Types Reference.