Frequently Asked Questions

The FAQ section is maintained by Luca Gibelli.

• What does WARNING: Current functionality level = 1, required = 2 mean?
  The functionality level of the database determines which scanner engine version is required to use all of its signatures. If you don't upgrade immediately you will be in big trouble.

• What does Your ClamAV installation is OUTDATED mean?
  You'll get this message whenever a new version of ClamAV is released. In order to detect all the latest viruses, it's not enough to keep your database up to date. You also need to run the latest version of the scanner. You can find the latest release at http://www.clamav.net under the stable link. Running the latest stable release also improves stability.

• What does WARNING: DNS record is older than 3 hours mean?
  freshclam attempts to detect potential problems with DNS caches and switches to the old mode if something looks suspicious. If this message appears seldomly, you can safely ignore it. If you get the error everytime you run freshclam, you should check your dns settings.

• What does SECURITY WARNING: NO SUPPORT FOR DIGITAL SIGNATURES mean?
  The ClamAV package requires the GMP library to verify the digital signature of the virus database. When building ClamAV you need the GMP library and its headers: if you are using Debian just run apt-get install libgmp3-dev, if you are using an RPM based distribution install the gmp-devel package.

• How often is the virus database updated?
  The virus database is usually updated many times per week. Check out http://news.gmane.org/gmane.comp.security.virus.clamav.virusdb/ to see our response times to new threats. The virusdb team tries to keep up with the latest worm in the wild. When a new worm spreads out, often it is less than one hour before we release a database update. You can contribute to make the virusdb updating process more efficient by submitting samples of viruses via our web interface.

• I tried to submit a sample through the web interface, but it said the sample is already recognized by ClamAV. My clamscan tells me it's not. I already updated my database, what's wrong with my setup?
  Please run clamscan with the -mbox option. Also check that freshclam and clamscan are using the same path for storing/reading the database.

• ClamAV crashes/hangs/doesn't compile/doesn't start. Did I find a bug?
  Before reporting a bug, please download the latest CVS code and try to reproduce the bug with it. Chances are the bug you encountered has already been fixed. If you really feel like you found a bug, please send a message bugs*clamav.net.

• How do I automatically restart clamd when it dies?
  Set up a cronjob which checks that clamd is up and running, every XX minutes. You can find an example script in the contrib/clamdwatch/ directory.

• How do I keep my virus database up to date?
  ClamAV comes with freshclam, a tool which periodically checks for new database releases and keeps your database up to date.

• I'm running ClamAV on a lot of clients on my local network. Can I mirror the database locally so that each client doesn't have to download it from your servers?
  Sure, install a proxy server and then configure your freshclam clients to use it (watch for the HTTPProxyServer parameter in man freshclam.conf). Alternatively, you can configure a local webserver on one of your machines (say machine1.mylan) and let freshclam download the *.cvd files from http://database.clamav.net/ to the webserver's DocumentRoot. Finally, change freshclam.conf on your clients so that it reads: DatabaseMirror machine1.mylan First the database will be downloaded to the local webserver and then the other clients on the network will update their copy of the database from it.

• How can I list the virus signature names contained in the database?
  If you are using a recent version of ClamAV just run: $sigtool --list-sigs

• I found an infected file in my HD/floppy/mailbox, but ClamAV doesn't recognize it yet. Can you help me?
  Our virus database is kept up to date with the help of the community. Whenever you find a new virus which is not detected by ClamAV you should submit it on our website (go to www.clamav.net and click on submit sample). The virusdb team will review your submission and update the database if necessary. Before submitting a new sample:
  • check that the value of DatabaseDirectory, in both clamd.conf and
    freshclam.conf, is the same
  • update your database by running freshclam

• Why is ClamAV calling the XXX virus with another name?
  This usually happens when we add a signature before other AV vendors. No well-known name is available at that moment so we have to invent one. Renaming the virus after a few days would just confuse people more, so we usually keep on using our name for that virus. The only exception is when a new name is established soon after the signature addition. You can find more info about this in the virus naming page at http://www.clamav.net/cvdinfo.html

• How do I know when database updates are released?
  Subscribe to the clamav-virusdb mailing-list.

• How can I scan a file on my hard disk for viruses without installing ClamAV?
  Use the online scanning tool available at http://test-clamav.power-netz.de/

• I found a false positive in ClamAV virus database. What shall I do?
  Fill the form at http://www.clamav.net/sendvirus.html Be sure to select The file attached is... a false positive

• How do I verify the integrity of ClamAV sources?
  Using GnuPG (http://www.gnupg.org/) you can easily verify the authenticity of your stable release downloads by using the following method:
  • Download Tomasz Kojm's key from the clamav.net site:
    $ wget http://www.clamav.net/gpg/tkojm.gpg
  • Import the key into your local public keyring:
    \$ gpg --import tkojm.gpg
  • Download the stable release AND the corresponding .sig file to the same directory.
    

    	$ wget http://prdownloads.sourceforge.net/clamav/clamav-X.XX.tar.gz
    	$ wget http://prdownloads.sourceforge.net/clamav/clamav-X.XX.tar.gz.sig
    

  • Verify that the stable release download is signed with the proper key:
    $ gpg --verify clamav-X.XX.tar.gz.sig
  • Make sure the resulting output contain the following information:
    Good signature from Tomasz Kojm (tk*lodz.tpnet.pl)

• Can ClamAV disinfect files?
  No, it can't. We will add support for disinfecting OLE2 files in one of the next stable releases. There are no plans for disinfecting other types of files. There are many reasons for it: cleaning viruses from files is virtually pointless these days. It is very seldom that there is anything useful left after cleaning, and even if there is, would you trust it?

• When using clamscan, is there a way to know which message within an mbox is infected?
  No, clamscan stops at the first infected message. You can convert the mbox to Maildir format, run clamscan on it and then convert it back to mbox format. There are many tools available which can convert to and from Maildir format, e.g: formail, mbox2maildir, and maildir2mbox.

• I'm running qmail+Qmail-Scanner+ClamAV and get the following error in my mail logs: clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem. What's wrong with it?
  Most likely clamd is not running at all, or you are running Qmail-Scanner and clamd under a different uid. If you are running Qmail-Scanner as qscand (default setting) you could put User qscand inside your clamd.conf file and restart clamd. Remember to check that qscand can create clamd.ctl (usually located at /var/run/clamav/clamd.ctl). The same applies to the log file.

• How do I use ClamAV with p3scan?
  Add the following lines to your pop3vscan configuration file:

  	    virusregexp = .*: (.*) FOUND
  	    scanner = /usr/bin/clamdscan --no-summary -i
  	    scannertype = basic
  

• Where can I ask questions about using ClamAV?
  Subscribe to our clamav-users mailing-list at http://www.clamav.net/ml.html

• Where can I get the latest CVS snapshot of ClamAV?
  Basically, there are two ways:
  • Run
    cvs -d:pserver:anonymous@cvs.sourceforge.net:/cvsroot/clamav co clamav-devel
  • Visit http://www.clamav.net/snapshot/

• I'm a MS Windows user. Can I take advantage of ClamAV virus protection?
  Yes, you can use ClamWin, a port of ClamAV for win32 systems with a very nice graphic interface. Download it at http://www.clamwin.net

• Where can I find more information about ClamAV?
  Please read this documentation. You can also try searching the mailing list archives. If you can't find the answer, you can ask for support on the clamav-users mailing-list, but please before doing it, search the archives! Also, make sure that you don't send HTML-ized email messages and that you don't top-post (these violate the netiquette and lessen your chances of being answered).

• How can I contribute to the ClamAV project?
  There are many ways to contribute to the ClamAV project. See the donations page (http://www.clamav.net/donate.html for more info.