Cisco major new release of free antivirus package . Recall that the project passed into the hands of Cisco in 2013 after Sourcefire, which develops ClamAV and Snort. Project code licensed under GPLv2.
Key improvements:
- The functionality of transparent checking of opened files (on-access scanning, checking at the time of opening a file) has been moved from clamd to a separate clamonacc process, implemented by analogy with clamdscan and clamav-milter. This change made it possible to organize clamd as a normal user without the need to obtain root privileges. In addition, the ability to delete, copy or replace problematic files has been added to clamonacc, scanning of created and moved files has been adjusted, support for VirusEvent handlers in on-access mode has been provided;
- The freshclam program has been significantly redesigned, in which HTTPS support has appeared and the ability to work with mirrors that process requests on network ports other than 80. The basic operations of working with the database have been moved to a separate library libfreshclam;
- Added support for extracting data from egg archives (ESTsoft), which does not require installation of the non-free UnEgg library;
- Added the ability to limit the scan time, which is set to 120 seconds by default. The limit can be changed via the MaxScanTime directive in clamd.conf or the "--max-scantime" parameter in the clamscan utility;
- Improved handling of executable files with digital signatures . Added the ability to create white and black lists of certificates. Improved PE format parsing;
- Added the ability to create bytecode signatures for unpacking Mach-O and ELF executable files;
- reformatting the entire codebase using the clang-format utility;
- Automated testing of ClamAV in the Google OSS-Fuzz service has been set up;
- Work has been done to eliminate compiler warnings when building with the "-Wall" and "-Wextra" options;
- For the Windows platform, the clamsubmit utility and the clamscan metadata extraction mode (-gen-json) have been ported;
- The documentation has been moved to a dedicated section on and is now available online, in addition to being delivered inside an archive in the docs/html directory.
Source: opennet.ru