AFAIK you must give ClamAV the entire file. If you give ClamAV individual pieces, you will lose most detection, as a lot of signatures only trigger on certain file types, and a lot of signatures use special offsets eg. EP+0
On Thu, July 2, 2015 3:27 am, P K wrote: > Hi guys, > > > Waiting for your reply. It should be simpler answer. > > > Does ClamAv support virus checking in stream mode for large files? > > > If i have file size of 10Mb do i have to send all data to clamAv and > clamAv will send "status ok" or it can scan data in each packet and return > status for each segment? > > Thanks > > > On Tue, Jun 30, 2015 at 12:28 PM, P K <[email protected]> wrote: > > >> Hi Guys, >> >> >> I am new to Clamd and was trying to use it for virus scanning. >> >> >> I used squid + icap + clamAv. >> >> >> But i seen once all data is recieved clamAv INSTREAM is called and data >> is passed to it. >> >> Is it issue with icap server or Clamd doesn't support streaming >> support? >> >> Any guidance will be helpful for me >> and how can we make ClamAv streaming support. >> >> Awaiting for reply. >> >> >> >> --pk >> >> > _______________________________________________ > http://lurker.clamav.net/list/clamav-devel.html > Please submit your patches to our Bugzilla: http://bugs.clamav.net > > > http://www.clamav.net/contact.html#ml > > _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net http://www.clamav.net/contact.html#ml
