[clamav-users] Input Stream Scanning for very large files

Micah Snyder (micasnyd) micasnyd at cisco.com
Thu Jan 24 11:15:20 EST 2019


Unfortunately, ClamAV is not designed to parse and scan chunks of files individually. ClamAV does file typing by pattern matching starting from the beginning of a file.  Without this information, ClamAV won't know what type of file it is scanning and will treat it as generic binary or text data.  Further, if the files are compressed in any way, ClamAV won't be able to extract them without the entire file.

Regards,
Micah

Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.


On Jan 24, 2019, at 7:21 AM, Kushal Kumar <kkushal05 at yahoo.com<mailto:kkushal05 at yahoo.com>> wrote:

Hi,


We have a production use case where we have to scan very large files of size 10 GB - 200 GB. So while the files are uploading in chunks, we want to scan these chunks by passing this as an input stream to clam av.
Since, clam av supports input stream scanning, we need to know if this is achievable or not using clam av ?

Also, if the virus signature is spread across two chunks and clam av does not detect them on individual chunk scanning, but when these chunks assemble on filesystem the infected signature can get active.  Does clamav has any support to handle such scenarios ?

Best,
Kushal Kumar
Verizon, India

Sent from Yahoo Mail on Android<https://go.onelink.me/107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature>
_______________________________________________
clamav-users mailing list
clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190124/3f1bd0f4/attachment.html>


More information about the clamav-users mailing list