You can view the documentation below, or browse our GitHub Repository, where you can contribute to user manual and FAQ.
General | Installing ClamAV | How to Report A Bug | Miscellaneous FAQ | ClamAV Virus Database FAQ | End of Life Policy (EOL) | Potentially Unwanted Applications (PUA) | Mailing Lists FAQ | Troubleshooting FAQ | Safebrowsing | Upgrading ClamAV | ClamAV on Microsoft Windows FAQ | How do I ignore/whitelist a ClamAV signature? | Which Version of ClamAV should I use? | Uninstalling ClamAV | ClamAV Overview | Interpreting Scan Alerts FAQ | Freshclam FAQ
Manual | Clam AntiVirus 0.101.0 User Manual | Clam AntiVirus User Manual
Manual | UserManual | Installing ClamAV on Unix / Linux / macOS from Source | Installing ClamAV on Windows | Introduction | LibClamAV | On-Access Scanning | Creating signatures for ClamAV | Usage | ClamAV Development
Manual | UserManual | Installation-Unix | Installation on Debian and Ubuntu Linux Distributions | Installation on macOS (Mac OS X) | Installation on Redhat and CentOS Linux Distributions
Manual | UserManual | Signatures | Trusted and Revoked Certificates | Body-based Signature Content Format | Bytecode Signatures | Signatures based on container metadata | Database Info | Dynamic Configuration (DCONF) | Passwords for archive files \[experimental\] | Extended signature format | File Type Magic | ClamAV File Types | Functionality Levels (FLEVELs) | File hash signatures | Logical signatures | PhishSigs | Whitelist databases | Using YARA rules in ClamAV
Manual | UserManual | Usage | Configuration | Scanning | Signature Testing and Management
Additional | Microsoft Authenticode Signature Verification | Private Local Mirrors
ClamAV supports a limited set of configuration options that may be enabled or disabled via settings in the *.cfg
database. At this time, these settings are distributed in daily.cfg
.
The goal of DCONF is to enable the ClamAV team to rapidly disable new or experimental features for specific ClamAV versions if a significant defect is discovered after release.
This database is small, and the settings are largely vestigial. The team has not had a need to disable many features in a long time, and so the ClamAV versions in the settings at this time should no longer be in use.
The strings and values referenced in daily.cfg
are best cross-referenced with the macros and structures defined here:
The format for a DCONF signature is:
Category:Flags:StartFlevel:EndFlevel
Category
may be one of:
Flags
:
Every feature that may be configured via DCONF is listed in struct dconf_module modules
in libclamav/dconf.c
. Any given feature may be default-on or default-off. Default-on features have the 4th field set to a 1
and default off are set to 0
. The Flags
field for a given Category
overrides the defaults for all of the options listed under that category.
A settings of 0x0
, for example, means that all options the category be disabled.
The macros listed in libclamav/dconf.h
will help you identify which bits to set to get the desired results.
StartFlevel
:
This is the FLEVEL of the minimum ClamAV engine for which you want the settings to be in effect.
EndFlevel
:
This is the FLEVEL of the maximum ClamAV engine for which you want the settings to be in effect. You may wish to select 255
to override the defaults of future releases.
Consider the OTHER_CONF_PDFNAMEOBJ
option in the category
OTHER
.
#define OTHER_CONF_UUENC 0x1 // Default: 1 #define OTHER_CONF_SCRENC 0x2 // Default: 1 #define OTHER_CONF_RIFF 0x4 // Default: 1 #define OTHER_CONF_JPEG 0x8 // Default: 1 #define OTHER_CONF_CRYPTFF 0x10 // Default: 1 #define OTHER_CONF_DLP 0x20 // Default: 1 #define OTHER_CONF_MYDOOMLOG 0x40 // Default: 1 #define OTHER_CONF_PREFILTERING 0x80 // Default: 1 #define OTHER_CONF_PDFNAMEOBJ 0x100 // Default: 1 #define OTHER_CONF_PRTNINTXN 0x200 // Default: 1 #define OTHER_CONF_LZW 0x400 // Default: 1
All of the OTHER
options, including OTHER_CONF_PDFNAMEOBJ
are default-on. To disable the option for ClamAV v0.100.X but leave the other options in their default settings, we would need to set the flags to:
0110 1111 1111 ^pdfnameobj off
Or in hex: 0x6FF
The example setting to place in daily.cfg
then woudl be:
OTHER:0x6FF:90:99