Hi,
when scanning a PDF with clamscan 0.90rc2 with experimental code
enabled, no phishing check is needed, thus I ran
clamscan --no-phishing-scan-urls --debug Encrypted.pdf; echo Exit code: $?
However, this does not disable the phishcheck routines, which leads to
long scanning time for only this single file (see below).
LibClamAV debug: Initializing the engine structure
LibClamAV debug: Initializing phishcheck module
LibClamAV debug: Compiling
regex:^(a[dfilmoqrtuwxz]|b[bdeghijmorstwyz]|c[ahlmnosuy]|d[ejkmz]|e[cegrstu]|f[ijr]|g[abdeghilmnprtuwy]|h[nrtu]|i[delnqst]|j[emop]|k[eghimwz]|l[birstuv]|m[acglmnoqrstuvwxyz]|n[aegilopru]|om|p[aehkltwy]|qa|r[ow]|s[cdeginorz]|t[dghjklmnorvwz]|u[agyz]|v[enu]|ws|y[etu])$
LibClamAV debug: Compiling
regex:^(A[CDEFGILMNOQRSTUWXZ]|B[ABDEFGHIJMNORSTVWYZ]|C[ACDFGHIKLMNORUVXYZ]|D[EJKMOZ]|E[CEGRSTU]|F[IJKMOR]|G[ABDEFGHILMNPQRSTUWY]|H[KMNRTU]|I[DELMNOQRST]|J[EMOP]|K[EGHIMNRWYZ]|L[ABCIKRSTUVY]|M[ACDGHKLMNOPQRSTUVWXYZ]|N[ACEFGILOPRUZ]|OM|P[AEFGHKLMNRSTWY]|QA|R[EOUW]|S[ABCDEGHIJKLMNORTUVYZ]|T[CDFGHJKLMNOPRTVWZ]|U[AGKMSYZ]|V[ACEGINU]|W[FS]|Y[ETU]|Z[AMW]|BIZ|CAT|COM|EDU|GOV|INT|MIL|NET|ORG|PRO|AERO|ARPA|COOP|INFO|JOBS|MOBI|NAME|MUSEUM)$
LibClamAV debug: Compiling regex:^
*(([a-zA-Z]([-$_@&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})*:(//)?)?(([-$_@&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})|\+)+\.((([-$_@&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})|\+)+\.)*(A[CDEFGILMNOQRSTUWXZ]|B[ABDEFGHIJMNORSTVWYZ]|C[ACDFGHIKLMNORUVXYZ]|D[EJKMOZ]|E[CEGRSTU]|F[IJKMOR]|G[ABDEFGHILMNPQRSTUWY]|H[KMNRTU]|I[DELMNOQRST]|J[EMOP]|K[EGHIMNRWYZ]|L[ABCIKRSTUVY]|M[ACDGHKLMNOPQRSTUVWXYZ]|N[ACEFGILOPRUZ]|OM|P[AEFGHKLMNRSTWY]|QA|R[EOUW]|S[ABCDEGHIJKLMNORTUVYZ]|T[CDFGHJKLMNOPRTVWZ]|U[AGKMSYZ]|V[ACEGINU]|W[FS]|Y[ETU]|Z[AMW]|BIZ|CAT|COM|EDU|GOV|INT|MIL|NET|ORG|PRO|AERO|ARPA|COOP|INFO|JOBS|MOBI|NAME|MUSEUM)(/((([EMAIL
PROTECTED]&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})|\+)+/?)*)?(\?(([EMAIL
PROTECTED]&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})+\+)*)?(#([EMAIL
PROTECTED]&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})+)?|(http|https|ftp)://.+) *$
LibClamAV debug: Compiling regex:^
*([a-zA-Z]([-$_@&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})*:(//)?)?[0-9]{1,3}(\.[0-9]{1,3}){3}(:(([-$_@&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})|\+)+)?(/((([EMAIL
PROTECTED]&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})|\+)+/?)*)?(\?(([EMAIL
PROTECTED]&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})+\+)*)?(#([EMAIL
PROTECTED]&a-zA-Z0-9!*"'(),]|%[0-9a-fA-f]{2})+)? *$
LibClamAV debug: Phishcheck module initialized
LibClamAV debug: Loading databases from /var/lib/clamav
LibClamAV debug: in cli_cvdload()
LibClamAV debug: MD5(.tar.gz) = d0a9fa66832911ae22252d3c356ca8c6
LibClamAV debug: cli_versig: Decoded signature: d0a9fa66832911ae22252d3c356ca8c6
LibClamAV debug: cli_versig: Digital signature is correct.
LibClamAV debug: in cli_untgz()
LibClamAV debug: Unpacking /tmp/clamav-6304ae1deda6367392ed0561f818cc8c/COPYING
LibClamAV debug: Unpacking /tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.db
LibClamAV debug: Unpacking
/tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.hdb
LibClamAV debug: Unpacking
/tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.ndb
LibClamAV debug: Unpacking
/tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.zmd
LibClamAV debug: Unpacking /tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.fp
LibClamAV debug: Unpacking
/tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.info
LibClamAV debug: Loading databases from
/tmp/clamav-6304ae1deda6367392ed0561f818cc8c
LibClamAV debug: Initializing engine->root[0]
LibClamAV debug: Initialising AC pattern matcher of root[0]
LibClamAV debug: Initializing BM tables of root[0]
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Initializing engine->root[1]
LibClamAV debug: Initialising AC pattern matcher of root[1]
LibClamAV debug: Initializing BM tables of root[1]
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Initializing engine->root[2]
LibClamAV debug: Initialising AC pattern matcher of root[2]
LibClamAV debug: Initializing BM tables of root[2]
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Initializing engine->root[3]
LibClamAV debug: Initialising AC pattern matcher of root[3]
LibClamAV debug: Initializing BM tables of root[3]
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Initializing engine->root[4]
LibClamAV debug: Initialising AC pattern matcher of root[4]
LibClamAV debug: Initializing BM tables of root[4]
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Initializing engine->root[5]
LibClamAV debug: Initialising AC pattern matcher of root[5]
LibClamAV debug: Initializing BM tables of root[5]
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Initializing engine->root[6]
LibClamAV debug: Initialising AC pattern matcher of root[6]
LibClamAV debug: Initializing BM tables of root[6]
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: /tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.db loaded
LibClamAV debug: Initializing md5 list structure
LibClamAV debug: /tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.hdb loaded
LibClamAV debug: /tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.ndb loaded
LibClamAV debug: /tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.zmd loaded
LibClamAV debug: /tmp/clamav-6304ae1deda6367392ed0561f818cc8c/daily.fp loaded
LibClamAV debug: /var/lib/clamav/daily.cvd loaded
LibClamAV debug: in cli_cvdload()
LibClamAV debug: MD5(.tar.gz) = c6c0e5c39b28fdbc7f2e23ce1c5166fc
LibClamAV debug: cli_versig: Decoded signature: c6c0e5c39b28fdbc7f2e23ce1c5166fc
LibClamAV debug: cli_versig: Digital signature is correct.
LibClamAV debug: in cli_untgz()
LibClamAV debug: Unpacking /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/COPYING
LibClamAV debug: Unpacking /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.db
LibClamAV debug: Unpacking /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.hdb
LibClamAV debug: Unpacking /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.ndb
LibClamAV debug: Unpacking /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.zmd
LibClamAV debug: Unpacking /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.fp
LibClamAV debug: Unpacking
/tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.info
LibClamAV debug: Loading databases from
/tmp/clamav-e892e01c86abe9b071f514bd45d1efb3
LibClamAV debug: /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.db loaded
LibClamAV debug: /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.hdb loaded
LibClamAV debug: /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.ndb loaded
LibClamAV debug: /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.zmd loaded
LibClamAV debug: /tmp/clamav-e892e01c86abe9b071f514bd45d1efb3/main.fp loaded
LibClamAV debug: /var/lib/clamav/main.cvd loaded
LibClamAV debug: Recognized PDF document file
LibClamAV debug: in cli_pdf(/tmp/clamav-6c94fe2b25cc33a2694c264ac67381e8)
LibClamAV debug: cli_pdf: scanning 375187 bytes
LibClamAV Warning: Encrypted PDF files not yet supported
LibClamAV debug: Descriptor[3]: Bad format or broken data
Encrypted.pdf: OK
LibClamAV debug: Cleaning up phishcheck
LibClamAV debug: Freeing phishcheck struct
LibClamAV debug: Phishcheck cleaned up
----------- SCAN SUMMARY -----------
Known viruses: 75216
Engine version: 0.90rc2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.36 MB
Time: 2.015 sec (0 m 2 s)
Exit code: 0
best,
rob.
--
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
