Cisco-Talos/clamav

Features

• Open-Source Antivirus Engines - Is the open-source antivirus engine that detects trojans, viruses, and malware using signature-based scanning.
• Signature-Based Threat Detectors - Identifies trojans, viruses, worms, and other threats by matching file contents against a database of known malicious signatures.
• Archive Malware Inspectors - Inspects compressed and archived file formats such as ZIP, CAB, RAR, and OLE2 by unpacking them during scans.
• Antivirus Scanning Daemons - Operates a multi-threaded background daemon that listens on Unix or TCP sockets and scans files on demand.
• Multi-Threaded Daemon Architectures - Operates a multi-threaded background daemon that handles concurrent scan requests over sockets.
• Antivirus Deployments - Runs the antivirus scanning engine inside Docker containers for isolated and portable malware detection.
• Antivirus Engine Deployments - Runs the antivirus scanning engine inside an isolated Docker container for portable malware detection.
• Executable Malware Parsers - Parses Windows PE, ELF, and Mach-O executables, including those packed with UPX, ASPack, and FSG.
• Archive Extractions - Extracts and inspects content from compressed and archived file formats including Zip, RAR, 7Zip, and many others.
• Malware Detection - Ships a bytecode interpreter that executes custom signatures for heuristic malware detection.
• Containerized Antivirus Daemons - Ships an official Docker image that runs clamd and freshclam as a containerized daemon.
• Automated Signature Database Updates - Downloads and updates virus signature databases automatically using scripted updates and DNS-based version queries.
• Malware Scanning - Provides a cross-platform malware scanner that runs on Linux, Windows, and macOS.
• Linux Malware Scanners - Scans files and directories on Linux systems for malware using signature-based detection.
• Cross-Platform Malware Inspectors - Inspects executables and archives across Windows, Linux, and macOS formats for known threats.
• On-Access File Scanners - Intercepts file access events on Linux and blocks reads until a real-time malware scan completes.
• Real-Time File Scanners - Monitors file system activity in real time and blocks access to infected files on Linux.
• Recursive Archive Unpacking - Provides recursive extraction of nested archives to inspect compressed files for malware.
• Signature Database Updaters - Automatically downloads and applies the latest malware signature databases on a scheduled basis.
• Command-Line Malware Scanners - Provides a command-line tool for one-time file scans without requiring a persistent daemon process.
• On-Access File Blockers - Monitors file system activity in real time on Linux and blocks access to infected files until scanning completes.
• Antivirus Client Libraries - Offers client libraries for Rust, Python, Ruby, Perl, PHP, Java, and Go to interact with the scanning daemon.
• Malware Scanners - Scans objects in cloud storage buckets like Amazon S3 for viruses using automated pipelines.
• Scan Target Directory Mounts - Mounts host directories into the container to scan files for malware using clamscan or clamdscan.
• Mail Server Antivirus Filters - Integrates with mail transfer agents via milter plugins to filter email attachments for malware.
• Mail Server Antivirus Integrations - Filters email messages for malware by connecting with mail transfer agents like Sendmail, Postfix, and Exim.
• Malware Filters - Integrates with mail transfer agents to scan email attachments and messages for viruses before delivery.
• Milter Protocol Filters - Integrates with mail transfer agents through milter protocol plugins for email malware filtering.
• High-Speed Malware Scanners - Scans files at high speed to detect malware without slowing down system operations.
• On-Access File Blocking - Intercepts file access requests on Linux and prevents reading until a scan completes, stopping threats in real time.
• On-Access File Scanners - Ships an on-access scanner that intercepts file reads on Linux and blocks access until scanning completes.
• Scan Depth and Size Limiters - Restricts the size, depth, and number of files scanned per request to prevent denial-of-service attacks.
• Unwanted Feature Blockers - Flags adware, toolbars, and other potentially unwanted applications during scans.
• Security & Privacy - Open-source antivirus engine.