forked from Cisco-Talos/clamav
-
Notifications
You must be signed in to change notification settings - Fork 0
/
README
1853 lines (1431 loc) · 69.4 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Note: This README/NEWS file refers to the source tarball. Some things described
here may not be available in binary packages.
--
0.92
----
This release provides various bugfixes, optimisations and improvements
to the scanning engine. The new features include support for ARJ and
SFX-ARJ archives, AutoIt, basic SPF parser in clamav-milter (to reduce
phishing false-positives), faster scanning and others (see ChangeLog).
To get a consistent behaviour of the anti-phishing module on all platforms,
libclamav now includes the regex library from OpenBSD.
--
The ClamAV team (http://www.clamav.net/team)
0.91.2
-------
This release fixes various bugs in libclamav, freshclam and clamav-milter,
and adds support for PUA (Potentially Unwanted Application) signatures
(clamscan: --detect-pua, clamd: DetectPUA).
** Announcement **
Dear ClamAV users,
On August 17, Sourcefire, the creators of Snort, acquired the ClamAV project.
The full announcement is available here:
http://www.sourcefire.com/products/clamav/
We'd like to thank everyone in the ClamAV community for their dedication to
the project. The acquisition by Sourcefire is a testament to the hard work of
the entire ClamAV community in developing cutting edge technology that truly
showcases the promise of the open source model. With the additional resources
Sourcefire will provide we look forward to working with the community to
continue the advancement of ClamAV.
Sourcefire now owns ClamAV project and related trademarks, as well as the
source code copyrights held by the five principal members of the ClamAV team.
Sourcefire will also assume control of the ClamAV project including: the
ClamAV.org domain, web site and web site content; and the ClamAV Sourceforge
project page.
What's most important is that from the end-user perspective very little will
change beyond the additional resources Sourcefire will provide in our
continued efforts to advance the ClamAV technology and improve our ability to
interact with the open source community. The core team will continue to lead
the advancement of ClamAV and the CVD as employees of Sourcefire. Both the
ClamAV engine and the signature database will remain under GPL.
For more information please visit our website and the following FAQ page:
http://www.clamav.net/support/sf-faq
--
The ClamAV team (http://www.clamav.net/team)
0.91.1
------
This release fixes stability and other issues of 0.91.
--
The ClamAV team (http://www.clamav.net/team)
0.91
----
ClamAV 0.91 is the first release to enable the anti-phishing technology
in default builds. This technology combines heuristics with special
signatures and provides effective protection against phishing threats.
Other important changes and add-ons in this version include:
- unpacker for NSIS (Nullsoft Scriptable Install System) self-extracting
archives
- unpacker for ASPack 2.12
- new implementation of the Aho-Corasick pattern matcher providing
better detection for wildcard enabled signatures
- support for nibble matching and floating offsets
- improved handling of .mdb files (fixes long startup times)
- extraction of PE files embedded into other executables
- better handling of PE & UPX
- removed dependency on libcurl (improves stability)
- libclamav.dll available under Windows
- IPv6 support in clamav-milter
- many other improvements and bugfixes
--
The ClamAV team (http://www.clamav.net/team)
0.90.3
------
This release fixes some security bugs in libclamav and improves stability
under Solaris. Please see ChangeLog for complete list of changes.
If your system is suffering from long clamscan startup times, please
consider installing 0.91rc1 which is due to be released shortly
after 0.90.3.
--
The ClamAV team (http://www.clamav.net/team)
0.90.2
------
This release fixes many problems in libclamav and freshclam.
--
The ClamAV team (http://www.clamav.net/team)
0.90.1
------
This release includes various bugfixes and code enhancements. Please
see ChangeLog for complete list of changes.
** Important note **: please run 'ldconfig' after installing this version.
--
The ClamAV team (http://www.clamav.net/team)
0.90
----
The ClamAV team is proud to announce the long awaited ClamAV 0.90.
This version introduces lots of new interesting features and marks
a big step forward in the development of our antivirus engine.
The most important change is the introduction of scripted updates.
Instead of transferring the whole cvd file at each update, only the
differences between the latest cvds and the previous versions will be
transferred.
In case the local copy of the latest cvd is corrupted or the scripted
update fails for some reason, freshclam will fallback to the old method.
Similarly to cvd files, scripted updates are compressed and digitally signed
and are already being distributed. They will dramatically reduce traffic on
our mirrors and will allow us to release even more updates in the future.
Another noticeable change is the new configuration syntax: you can now turn
single options on and off, the old crude hack of "DisableDefaultScanOptions"
is no longer required.
Cosmetic changes apart, the 0.9x series introduces lots of new code, but some
parts are not compiled in by default because they are not ready for production
systems yet. You are encouraged to pass the --enable-experimental flag to
./configure when compiling ClamAV. The experimental code introduces many
improvements in terms of detection rate and performances. If you find a bug,
please take some time to report it on our bugzilla: http://bugs.clamav.net.
Your help in testing the new code is really appreciated. The experimental code
introduces many improvements in terms of detection rate and performances.
RAR3, SIS and SFX archives support is finally available together with
new unpackers and decryptors: pespin, sue, yc, wwpack32, nspack, mew, upack
and others. Additionally, ClamAV now includes better mechanisms for scanning
ELF, PDF and tar files. The email decoding has been improved to reduce both
the memory requirements and the time taken to process attachments.
As part of the Google Summer of Code program, we have introduced support for
a new phishing signatures format that has proved very effective in detecting
phishing emails. The ClamAV phishing module allows better and more generic
detection of phishing emails by searching for URLs in email messages, and
comparing the real site with the URL displayed to the user in the message.
On the performance side, support for the MULTISCAN command has been
implemented in clamd, allowing to scan multiple files simultaneously.
Support for Sensory Networks' NodalCore acceleration technology
(http://www.clamav.net/nodalcore/) is now available in ClamAV and will be
compiled in if the ncore libraries are detected at compile time. NodalCore
acceleration allows highly improved scan speeds on systems equipped with
NodalCore cards.
Detailed list of changes:
-) libclamav:
+ New unpacker for RAR3, RAR2 and RAR1
+ Rewritten unpackers for Zip and CAB files
+ Support for RAR-SFX, Zip-SFX and CAB-SFX archives
+ New PE parsing model:
- Accurate virtual and raw size and offset calculations
- Proper parsing of executables with weird/handcrafted/uncommon headers
- Proper handling (or skipping) of ghost sections at various places in the
code
- Rebuild improvements for various unpackers
- Adjusted alignment on rebuilt executables
- Proper handling of out of sections offsets
- Broken exe detection now mimics the XPSP2 loader
- Lots of misc improvements and fixes
+ Support for PE32+ (64-bit) executables
+ Support for MD5 signatures based on PE sections (.mdb)
+ ELF file parser
+ Support for Sensory Networks' NodalCore hardware acceleration technology
+ Advanced phishing detection module (experimental)
+ Signatures are stored in separate trees depending on their target type
+ Algorithmic detection can be controlled with CL_SCAN_ALGORITHMIC
+ Support for new obfuscators: SUE, Y0da Cryptor, CryptFF
+ Support for new packers: NsPack, wwpack32, MEW, Upack
+ Support for SIS files (SymbianOS packages)
+ Support for PDF and RTF files
+ New encoding and entity normalizer (experimental)
-) clamd:
+ New config file parser:
* all options require arguments (options without args must be now followed
by boolean values: (yes, no), (1, 0), or (true, false)
* optional arguments (as in NotifyClamd) are no longer supported
* removed "DisableDefaultScanOptions" option (scan options can be
configured individually)
+ TCP and local sockets can be operated simultaneously
+ New command: MULTISCAN (scan directory with multiple threads)
+ New option AlgorithmicDetection
+ New option ScanELF
+ New option NodalCoreAcceleration (requires hardware accelerator)
+ New option PhishingSignatures
+ New options to control the phishing module:
- PhishingRestrictedScan
- PhishingScanURLs
- PhishingAlwaysBlockSSLMismatch
- PhishingAlwaysBlockCloak
-) clamav-milter:
+ Black list mode: optionally black lists an IP for a configurable amount
of time
+ Black hole mode: detects emails that will be discarded and refrains from
scanning them
+ Reporting: ability to report phishing attempts to anti-phishing
organisations to help close the sites
+ Improved load balancing for scanning with clusters
+ Removed -b option (enable BOUNCE compile time option to re-enable the
option)
-) clamscan:
+ New options: --no-phishing-sigs, --no-algorithmic (disable phishing and
algorithmic detection respectively)
+ New options to control the phishing module: --no-phishing-scan-urls,
--no-phishing-restrictedscan, --phishing-ssl, --phishing-cloak
+ New option: --ncore (requires hardware accelerator)
+ New option: --no-elf
+ New option: --copy
-) freshclam:
+ Interpreter for .cdiff files (scripted updates)
+ Initial version of mirror manager
+ New option: --list-mirrors (list details on mirrors accessed by the mirror
manager)
+ New option HTTPUserAgent to force different User-Agent header
-) sigtool:
+ New option: --utf16-decode (decode UTF16 encoded files)
+ New options: --diff, --run-cdiff, --verify-cdiff (update script management)
+ New option: --mdb (generated .mdb compatible signatures)
-) clamconf: initial version of configuration utility for clamd and freshclam
We are happy to announce new interesting software with support for ClamAV:
+ AqMail - a POP3 client with additional filtering
+ ClamFS - a FUSE-based file system with on-access anti-virus scanning
+ c-icap - an ICAP server coded in C with support for ClamAV
+ MailCleaner - a complete email filtering gateway
+ mod_streamav - a ClamAV based antivirus filter for Apache 2
+ pyClamd - a python interface to Clamd
More information at http://www.clamav.net/download/third-party-tools/
--
The ClamAV team (http://www.clamav.net/team)
0.88.7
------
This version improves scanning of mail and tar files.
--
The ClamAV team (http://www.clamav.net/team)
0.88.6
------
Changes in this release include better handling of network problems in
freshclam and other minor bugfixes.
The ClamAV developers encourage all users to give a try to the latest
beta version of 0.90!
--
The ClamAV team (http://www.clamav.net/team)
0.88.5
------
This version fixes a crash in the CHM unpacker and a heap overflow in the
function rebuilding PE files after unpacking.
--
The ClamAV team (http://www.clamav.net/team)
0.88.4
------
This release fixes a possible heap overflow in the UPX code.
See security information at: http://www.clamav.net/2006/08/07/security-fixes-in-0884
--
The ClamAV team (http://www.clamav.net/team)
0.88.3
------
This version fixes handling of large binhex files and multiple alternatives in
virus signatures.
--
The ClamAV team (http://www.clamav.net/team)
0.88.2
------
This release improves virus detection, fixes zip handling on 64-bit
architectures and possible security problem in freshclam.
Following the 0.88.1 release some portals and security related websites
published incorrect information on security problems of 0.88. To avoid
such incidents in the future, every new ClamAV package will be released
together with detailed information about security bugs it fixes. Details
for this version can be found here:
http://www.clamav.net/2006/08/07/security-fixes-in-0884
--
The ClamAV team (http://www.clamav.net/team)
0.88.1
------
This version fixes a number of minor bugs and provides code updates
to improve virus detection.
--
The ClamAV team (http://www.clamav.net/team)
0.88
----
A possible heap overflow in the UPX code has been fixed. General improvements
include better zip and mail processing, and support for a self-protection mode.
The security of the UPX, FSG and Petite modules has been improved, too.
--
The ClamAV team (http://www.clamav.net/team)
0.87.1
------
This release includes major bugfixes for problems with handling TNEF
attachments, cabinet files and FSG compressed executables.
--
The ClamAV team (http://www.clamav.net/team)
0.87
----
This version fixes vulnerabilities in handling of UPX and FSG compressed
executables. Support for PE files, Zip and Cabinet archives has been improved
and other small bugfixes have been made. The new option "--on-outdated-execute"
allows freshclam to run a command when system reports a new engine version.
--
The ClamAV team (http://www.clamav.net/team)
0.86.2
------
Changes in this release include fixes for three possible integer overflows
in libclamav, improved scanning of Cabinet and FSG compressed files, better
database handling in clamav-milter, and others.
--
The ClamAV team (http://www.clamav.net/team)
0.86.1
------
A possible crash in the libmspack's Quantum decompressor has been fixed.
--
The ClamAV team (http://www.clamav.net/team)
0.86
----
This release introduces a number of bugfixes and cleanups. Possible descriptor
leaks in archive unpackers and mishandling of fast track uuencoded files have
been fixed in libclamav. Database reloading in clamav-milter has been improved.
--
The ClamAV team (http://www.clamav.net/team)
0.85.1
------
A problem where an email with more than one content-disposition type line,
one or more of which was empty, could crash libclamav has been fixed. Other
minor bugfixes have been made.
--
The ClamAV team (http://www.clamav.net/team)
0.85
----
Bugfixes in this release include correct signature offset calculation in large
files, proper handling of encrypted zip archives, and others.
--
The ClamAV team (http://www.clamav.net/team)
0.84
----
This version improves detection of JPEG (MS04-028) based exploits, introduces
support for TNEF files and new detection mechanisms. Various bugfixes
(including problems with scanning of digest mail files) and improvements
have been made.
** We encourage users to help testing the development versions, now with **
** rewritten RAR code and support for 3.0 archives! **
** http://www.clamav.net/snapshot/ **
-) libclamav:
+ JPEG exploit detector now also checks embedded Photoshop thumbnail images
+ archive meta-data scanner (improves malware detection within encrypted
archives)
+ support for TNEF (winmail.dat) decoding
+ support for all tar archive formats
+ MD5 implementation replaced with a slightly faster one
+ improved database reloading with reference counter
+ database updateable false positive eliminator
+ speed improvements
+ various bugfixes
-) clamd:
+ VirusEvent now sets CLAM_VIRUSEVENT_FILENAME and CLAM_VIRUSEVENT_VIRUSNAME
environment variables
-) clamav-milter:
+ improved database update detection when not --external
-) clamscan:
+ new options --include-dir and exclude-dir
+ new option --max-dir-recursion
-) freshclam:
+ new directive LocalIPAddress
-) contrib:
+ clamdmon 1.0 - clamdwatch replacement written in C
-) 3rd party software:
+ hMailServer - open source e-mail server for Microsoft Window
+ pop3.proxy - proxy server for the POP3 protocol
+ HTTP Anti Virus Proxy
+ SmarterMail Filter - ClamAV based plugin for SmarterMail Mail Server
+ smf-clamd - small & fast virus filter for Sendmail
+ Squidclam - replacement for SquidClamAV-Redirector.py written in C
+ QtClamAVclient - remote clamd client based on the Qt Toolkit
+ qpsmtp - flexible smtpd daemon written in Perl
News:
Palo Alto, Calif. March 31st 2005 - Clam AntiVirus, the leading Open Source
antivirus toolkit, and Sensory Networks, the leading provider of hardware
acceleration for network security applications, announced a partnership
to provide hardware acceleration support for the Clam AntiVirus suite.
[...]
Support for Sensory Networks' NodalCore acceleration in ClamAV will be
available in version 0.90 of the software suite in Q3 2005. For more
information please visit:
http://www.clamav.net/partners/sensorynetworks
http://www.sensorynetworks.com/
The ClamAV project announces the opening of the official merchandise store:
http://www.cafepress.com/clamav/
A big thank you to Finndesign (http://www.finndesign.fi) which
volunteered to design the whole line of products, including:
- t-shirts (for women and men)
- golf shirt
- sweatshirt
- coffee mug
- mousepad
- stickers
- scrapbook
By purchasing our merchandise, you contribute to the development of ClamAV.
--
The ClamAV team (http://www.clamav.net/team)
0.83
----
Due to a high number of bad files produced by broken software, the MS05-002
exploit detector now only checks specific RIFF files. This version also fixes
a stability problem of clamav-milter/clamd and improves e-mail scanning.
--
The ClamAV team (http://www.clamav.net/team)
0.82
----
This release adds generic detection of MS05-002 ("Vulnerability in Cursor and
Icon Format Handling Could Allow Remote Code Execution") based exploits.
Fixes include correct attachment scanning in e-mails generated by some
Internet worms (broken in 0.81), removed false positive "Suspect.Zip"
warning on non-standard zip archives created by ICEOWS, better proxy support
in freshclam, and speed improvements.
--
The ClamAV team (http://www.clamav.net/team)
0.81
----
Scan engine improvements were made. The internal mail scanner now supports
multipart/partial messages, and support for decoding non-standard mail files
was greatly enhanced. clamav-milter by default uses libclamav and scans emails
itself without the use of clamd. libclamav can now extract RFC2397 encoded
data within HTML documents, block zip archives with modified information in
local header, and scan HQX files. PE file structure rebuilding from compressed
executables was improved.
Important note to clamdwatch users: please upgrade to the latest version
(contrib/clamdwatch) as soon as possible.
-) libclamav:
+ major improvements in the mail scanning engine:
o support for multipart/partial messages
o improved support for non-standard quoted-printable attachments
o in some situations it will try to guess a correct mode (e.g.
a good type for an incorrect content-type, a best guess for an
unknown encoding type, etc.)
o handling of RFC822 comments in the commands (e.g.: Co(foo)ntent-Type:
text/plain)
o better recovery if memory softlimit is hit
o new test code that decodes emails without parsing them first (must
be enabled manually before compilation)
+ support for extracting RFC2397 encoded data within HTML documents
+ blocking of zip archives with modified information in local header
+ improved PE structure rebuilding from compressed executables
+ improved support for zip archives
+ support for Mac's HQX file format
+ stability and (minor) security fixes
+ a lot of minor improvements, including support for new platforms
-) clamd:
+ new directive ExitOnOOM (stop the deamon when libclamav reports an out of
memory condition)
+ new directives StreamMinPort and StreamMaxPort (port range specification
for a stream mode)
+ support for passing of file descriptors
-) clamdscan:
+ added support for --move and --remove
-) clamav-milter:
+ by default uses libclamav to scan e-mails
+ new option --external (enables the use of clamd)
+ various optimisations
-) freshclam:
+ the DNS mode is now enabled by default (no need for DNSDatabaseInfo in
freshclam.conf)
+ --no-dns uses a If-Modified-Since method instead of a range GET
+ added support for AllowSupplementaryGroups
-) sigtool:
+ new options --vba and --vba-hex (extract VBA/Word6 macros and optionally
display the corresponding hex values; Word6 binary code will be
disassembled)
-) The list of third party programs with support for ClamAV is growing
rapidly. Here are the latest additions (see clamdoc.pdf for details):
+ AVScan - a libclamav based GUI a-v scanner for Unix
+ clamailfilter - a Python script that provides a-v scanning via procmailrc
+ ClamAVPlugin - A ClamAV plugin for SpamAssassin 3.x
+ ClamCour - an e-mail filter for Courier
+ clamfilter - a small, secure, and efficient content filter for Postfix
+ ClamMail - an anti-virus POP3 proxy for Windows
+ ClamShell - a Java GUI for clamscan
+ ClamTk - a perl-tk GUI for ClamAV
+ clapf - a virus scanning and antispam content filter for Postfix
+ D bindings for ClamAV - ClamAV bindings for the D programming language
+ Frox - a transparent FTP proxy
+ KMail - a fully-featured email client now supports ClamAV out of box
+ Mail Avenger - a highly-configurable SMTP server with a-v support
+ Mailnees - a mail content filter for Sendmail and Postfix
+ Maverix - anti-spam and anti-virus solution for AOLServer
+ Moodle - scan files submitted by students for viruses!
+ php-clamav - scan files from within PHP
+ pymavis - a powerful email parser, similar to the old amavis-perl
+ QClam - a simple program to plug ClamAV to a qmail mailbox
+ qmailmrtg7 - display graphs of viruses found by ClamAV
+ qSheff - an e-mail filter for qmail
+ SafeSquid - a feature rich content filtering internet proxy
+ Scrubber - a server-side daemon for filtering mail content
+ simscan - an e-mail and spam filter for qmail
+ smtpfilter - scan SMTP session for viruses
+ snort-inline - scan your network traffic for viruses with ClamAV
+ SquidClamAV Redirector - a Squid helper script which adds virus scanning
+ WRAVLib - a library for a-v integration with Mono/.NET applications
--
The ClamAV team (http://www.clamav.net/team)
0.80
----
Stable version. Please read the release notes for the candidate versions below.
--
The ClamAV team (http://www.clamav.net/team)
0.80rc4
-------
Improvements in this release include better JPEG exploit verification,
faster base64 decoding, support for GNU tar files, updated on-access scanner,
and others.
--
The ClamAV team (http://www.clamav.net/team)
0.80rc3
-------
This release candidate eliminates possible false positive alerts in UPX/FSG
compressed files and clarifies behaviour of default actions in clamd and
freshclam.
We encourage users to take advantage of our new mirror structure. In order to
download the database from the closest mirror you should configure freshclam
to use db.XY.clamav.net where XY is your country code (see
http://www.iana.org/cctld/cctld-whois.htm for the full list). Please add
the following lines to freshclam.conf:
DNSDatabaseInfo current.cvd.clamav.net
DatabaseMirror db.XY.clamav.net
DatabaseMirror database.clamav.net
DNSDatabaseInfo enables database and software version verification through
DNS TXT records, and the second database mirror acts as a fallback in case
a connection to the first mirror fails for some reason.
0.80rc2
-------
This update fixes a serious bug in e-mail scanner.
0.80rc
------
The development version of ClamAV is ready for general testing! New mechanisms
have already proved very nasty to Internet worms successfully protecting
against the new versions R, S, T, U, V and W of the infamous Mydoom worm
and detecting them as Worm.Mydoom.Gen before they were analysed and specific
signatures added by the ClamAV database maintainers. That means servers running
the new version of ClamAV have detected and blocked 100% of Mydoom attacks!
New features in this release include:
-) libclamav
+ Portable Executable analyser (CL_SCAN_PE) featuring:
o UPX decompression (all versions)
o Petite decompression (2.x)
o FSG decompression (1.3, 1.31, 1.33)
o detection of broken executables (CL_SCAN_BLOCKBROKEN)
+ new, memory efficient, pattern matching algorithm (multipattern variant
of Boyer-Moore) - it's now primary matcher and Aho-Corasick is only used
for regular expression extended signatures
+ new signature format with advanced target type and offset specification
+ support for MD5 based signatures
+ extended regular expression scanner
+ added support for MS cabinet files
+ added support for CHM files
+ added support for POSIX tar archives
+ scanning inside PowerPoint documents
+ HTML normaliser with support for decoding of MS Script Encoder code
+ great improvements in e-mail scanner (now handles even more worm tricks)
+ new method of mail files detection
+ all e-mail attachments are now scanned (previously only the first ten
attachments were scanned)
+ added support for scanning URLs in e-mails (CL_SCAN_MAILURL)
+ detection of Worm.Mydoom.M.log
+ updated API (still backward compatible but please consult clamdoc.pdf
(Section 6) and adapt your software)
-) clamd
+ new directive ScanHTML (enables HTML normalisator and ScrEnc decoder)
+ new directive ScanPE (win32 executable analyser and decompressor)
+ new directive DetectBrokenExecutables (try to detect broken executables
and mark them as Broken.Executable)
+ new directive MailFollowURLs (try to download and scan files from URLs
in mails. BE CAREFUL! DO NOT ENABLE IT ON LOADED MAIL SERVERS)
+ new directive ArchiveBlockMax (archives that exceed limits will be
marked as viruses)
+ clamav.conf was renamed clamd.conf
-) clamscan
+ mail files are scanned by default, use --no-mail to disable it
+ new option --no-html (disables HTML normalisator)
+ new option --no-pe (disables PE analyser)
+ new option --detect-broken
+ new option --block-max
+ new option --mail-follow-urls (download and scan files from URLs in mails)
-) clamdscan
+ now prints warnings if some activated command line options are only
supported by clamscan
+ added support for archive scanning in stdin mode
-) clamav-milter
+ improved template file format
+ quarantined file names now contain virus names
+ initial support for SESSION mode of clamd
-) freshclam:
+ new directive DNSDatabaseInfo that enables ultra lightweight version
verification method through DNS (using TXT records). Based on idea by
Christopher X. Candreva and enabled by default.
(see http://www.gossamer-threads.com/lists/clamav/users/11102)
+ new option --no-dns (quick option to disable DNS method without editing
freshclam.conf)
-) sigtool
+ removed ability of automatic signature generation (use MD5 sums to
create your own signatures, see signatures.pdf for details)
+ new option --md5
+ new option --html-normalise (saves HTML normalisation and decryption
results in three html files in current directory)
-) configure:
+ new option --disable-gethostbyname_r (try enabling it if clamav-milter
compilation fails)
+ new option --disable-dns (try enabling it if freshclam compilation fails)
+ extended regular expression scanner
-) documentation
+ included new Mac OS X installation instructions
+ official documentation rewritten and outdated docs removed
-) new 3rd party software with support for ClamAV:
+ OdeiaVir - an e-mail filter for qmail and Exim
+ ClamSMTP - a lightweight (written in C) and simple filter for Postfix
+ Protea AntiVirus Tools - a virus filter for Lotus Domino
+ PTSMail Utilities - an e-mail filter for Sendmail
+ mxGuard for IMail - a mail filter for Ipswitch IMail (W32)
+ Zabit - a content and attachment filter for qmail
+ BeClam - ClamAV port for BeOS
+ clamXav - a virus scanner with GUI for Mac OS X
Special thanks to aCaB for his work on UPX, FSG and Petite decompressors.
Thanks to good reaction times on new threats ClamAV was awarded as best
security tool for 2004 by Linux Journal: "...With this year's outbreak of
e-mail worms for non-Linux platforms, ClamAV has been getting quite a workout,
and Linux admins on mailing lists report that database update times are keeping
up with or beating the proprietary alternatives." Thanks!
SourceWear.com is selling some very nice t-shirts and polo shirts powered by
ClamAV. Wear them and virus writers will stay away from you :-) A quarter out
of every dollar profited from the sale of these shirts will go to the ClamAV
project. Visit http://www.sourcewear.com and click on ClamAV logo!
--
The ClamAV team (http://www.clamav.net/team)
0.75
----
This release fixes detection of e-mails generated by Worm.Mydoom.I.
Important notice for people using ClamAV 0.60:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Our logs show that there is still a small percentage of ClamAV 0.60
installations updating their database. ClamAV 0.60 was released on
July 29th, 2003 and it was the last release to use the old database
format. Starting from version 0.65, released on November 12nd, ClamAV
uses a new database format, which is compressed and digitally signed.
We have been distributing the database in both formats till now, but
we plan to drop support for ClamAV 0.60 on September 1st.
We encourage _all_ users to upgrade to the latest release available.
People running an old version of ClamAV are missing many viruses and
may experience stability problems.
On non-production systems you can try the latest development version.
The new engine not only speeds up the scanning process but also limits
memory usage by about 8 MB ! It's able to scan new formats, including
CAB, CHM, UPX, HTML (normalisation), PowerPoint macros and can detect
annoying e-mails with empty attachments generated by new Bagle variants.
--
The ClamAV team (http://www.clamav.net/team)
0.74
----
Bugfixes in this version include crashes with multipart/mixed messages
and corrupted OLE2 and Zip files. Improvements include various optimisations
of mail scanning and clamav-milter and clamdscan behaviour.
New members of our "3rd party software" list:
+ MyClamMailFilter an e-mail filter for procmail (written in C)
+ clamaktion scan files from the right-click Konqueror menu
+ QMVC Qmail Mail and Virus Control
+ pyclamav Python binding for ClamAV
+ FETCAV Front End To Clam AntiVirus based on Xdialog
+ Famuko an on-access scanner working in a userspace
+ SoftlabsAV a generic anti-virus filter for procmail
Japanese users can take an advantage of the new ClamAV related site:
http://clamav-jp.sourceforge.jp/
and join the clamav-jp-users mailing list.
--
The ClamAV team (http://www.clamav.net/team)
0.73
----
This version fixes memory management problems in the OLE2 decoder and
improves mail scanning. Because of the rapid ClamAV development the team
encourages users to help in testing new features:
http://www.clamav.net/snapshot
Thank you for using ClamAV !
--
The ClamAV team (http://www.clamav.net/team)
0.72
----
Major bugfixes in this release include crashes with corrupted BinHex messages
and some Excel documents. Protection against archive bombs (not fully
functional since 0.70) was improved and a number of other improvements were
made.
--
The ClamAV team (http://www.clamav.net/team)
0.71
----
This release fixes all bugs found in 0.70 and introduces a few new features -
the noteworthy changes include:
-) libclamav:
+ support nested OLE2 files
+ support Word6 macro code
+ ignore popular file types (media, graphics)
+ support compress.exe (SZDD) compression (test/test.msc)
+ improve virus detection in e-mails
-) clamscan:
+ automatically decide (by comparing daily.cvd version numbers) which
database directory (hardcoded or clamav.conf's one) to use
+ support compression ratio feature (--max-ratio)
+ allow regular expressions in --[in|ex]clude
+ do not overwrite old files in a quarantine directory but add a numerical
extension to new files
+ respect --tempdir in libclamav
+ fix access problem when calling external unpackers in a superuser mode
+ fix file permission corruption with --deb in a superuser mode
-) clamd
+ support log facility specification in syslog's style (LogFacility)
+ new directive LeaveTemporaryFiles (Debug no longer leaves temporary
files not removed)
-) clamav-milter:
+ include the virus name in the 550 rejection
+ support user defined template for virus notifications (--template-file)
+ sort quarantine messages by date
+ improve thread management
+ add X-Virus-Scanned and X-Infected-Received-From: headers
+ improve load balancing (when using remote servers with --server)
+ send 554 after DATA received, not 550
+ save PID (--pidfile)
-) documentation:
+ German clamdoc.pdf translation (Rupert Roesler-Schmidt and Karina
Schwarz, uplink coherent solutions, http://www.uplink.at)
+ new Japanese documentation (Masaki Ogawa)
--
The ClamAV team (http://www.clamav.net/team)
0.70
----
The two major changes in this version are new thread manager in clamd
and support for decoding MS Office VBA macros. Both of them have been
implemented by Trog. Besides, there are many improvements and bugfixes
(all listed in ChangeLog), a short summary:
-) clamd
+ new thread manager (with better SMP support)
+ on-access scanning now also available on FreeBSD (with Dazuko 2.0)
+ new directive ArchiveBlockEncrypted
+ new directive ReadTimeout (replaces ThreadTimeout)
+ handle SIGHUP (re-open logfile) and SIGUSR2 (reload database)
+ respect TCPAddr in stream scanner
-) clamav-milter:
+ TCPWrappers support
-) libclamav:
+ support MS Office documents (OLE2) and VBA macro decoding
+ support encrypted archive detection
+ new flags: CL_OLE2, CL_ENCRYPTED (see clamdoc.pdf, Section 6.1)
+ improve virus detection in big files
+ improve support for multipart, bounce and embedded RFC822 messages
+ improve RAR support
+ include backup snprintf implementation
-) clamscan:
+ new option: --block-encrypted
-) freshclam
+ new option: --pid, -p (write pid file if run as daemon)
+ handle SIGHUP (re-open logfile), SIGTERM (terminate with log message),
SIGALRM and SIGUSR1 (wake up and check mirror)
+ fix bug with -u and -c handling
-) contrib
+ windows clamd client now available with source code
-) documentation:
+ new Polish documentation on ClamAV and Samba integration
+ official documentation updated
Special thanks to Dirk Mueller <mueller*kde.org> for his code review,
many bugfixes and cleanups.
Thanks to the help of many companies (clamdoc.pdf: Section 2.10,
http://www.clamav.net/mirrors.html) we have 49 very fast and reliable
virus database mirrors in 22 regions and the number is still growing.
As of March 2004 we attempt to redirect our users to the closest pool
of mirrors by looking at their ip source address when they try to resolve
database.clamav.net. Our DNS servers can answer with a CNAME to:
db.europe.clamav.net, db.america.clamav.net, db.asia.clamav.net or