##
## clamd.conf - automatically generated by clamconf 1.4.1
##

# Comment out or remove the line below.
#Example

# 
# Default: no
#AlertExceedsMax 

# Number of entries the cache can store.
# Default: 65536
#CacheSize 65536

# Enable prelude
# Default: no
#PreludeEnable 

# Name of the analyzer as seen in prewikka
# Default: disabled
#PreludeAnalyzerName 

# Save all reports to a log file.
# Default: disabled
#LogFile /tmp/clamav.log

# By default the log file is locked for writing and only a single
# daemon process can write to it. This option disables the lock.
# Default: no
#LogFileUnlock yes

# Maximum size of the log file.
# Value of 0 disables the limit.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 1048576
#LogFileMaxSize 5M

# Log time with each message.
# Default: no
#LogTime yes

# Log all clean files.
# Useful in debugging but drastically increases the log size.
# Default: no
#LogClean yes

# Use the system logger (can work together with LogFile).
# Default: no
#LogSyslog yes

# Type of syslog messages.
# Please refer to 'man syslog' for the facility names.
# Default: LOG_LOCAL6
#LogFacility LOG_MAIL

# Enable verbose logging.
# Default: no
#LogVerbose yes

# Rotate log file. Requires LogFileMaxSize option set prior to this option.
# Default: no
#LogRotate yes

# Log additional information about the infected file, such as its
# size and hash, together with the virus name.
# Default: no
#ExtendedDetectionInfo yes

# Save the process ID to a file.
# Default: disabled
#PidFile /run/clamav/clam.pid

# This option allows you to change the default temporary directory.
# Default: disabled
#TemporaryDirectory /tmp

# This option allows you to change the default database directory.
# If you enable it, please make sure it points to the same directory in
# both clamd and freshclam.
# Default: /var/lib/clamav
#DatabaseDirectory /var/lib/clamav

# Only load the official signatures published by the ClamAV project.
# Default: no
#OfficialDatabaseOnly no

# Return with a nonzero error code if the virus database is older than the specified number of days.
# Default: disabled
#FailIfCvdOlderThan -1

# Path to a local socket file the daemon will listen on.
# Default: disabled
#LocalSocket /run/clamav/clamd.sock

# Sets the group ownership on the unix socket.
# Default: disabled
#LocalSocketGroup virusgroup

# Sets the permissions on the unix socket to the specified mode.
# Default: disabled
#LocalSocketMode 660

# Remove a stale socket after unclean shutdown
# Default: yes
#FixStaleSocket yes

# A TCP port number the daemon will listen on.
# Default: disabled
# Exposing a TCP socket lets local tools like clamdscan and virus scanners
# contact clamd without needing a shared Unix socket path.
TCPSocket 3310

# By default clamd binds to INADDR_ANY.
# This option allows you to restrict the TCP address and provide
# some degree of protection from the outside world.
# Default: disabled
# Binding only to localhost prevents external hosts from submitting files to clamd.
TCPAddr localhost

# Maximum length the queue of pending connections may grow to.
# Default: 200
#MaxConnectionQueueLength 30

# Close the STREAM session when the data size limit is exceeded.
# The value should match your MTA's limit for the maximum attachment size.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 104857600
#StreamMaxLength 100M

# The STREAM command uses an FTP-like protocol.
# This option sets the lower boundary for the port range.
# Default: 1024
#StreamMinPort 1024

# This option sets the upper boundary for the port range.
# Default: 2048
#StreamMaxPort 2048

# Maximum number of threads running at the same time.
# Default: 10
#MaxThreads 20

# This option specifies the time (in seconds) after which clamd should
# timeout if a client doesn't provide any data.
# Default: 120
#ReadTimeout 120

# This option specifies the time (in seconds) after which clamd should
# timeout if a client doesn't provide any initial command after connecting.
# Default: 30
#CommandReadTimeout 30

# This option specifies how long to wait (in milliseconds) if the send buffer
# is full. Keep this value low to prevent clamd hanging.
# Default: 500
#SendBufTimeout 200

# Maximum number of queued items (including those being processed by MaxThreads
# threads). It is recommended to have this value at least twice MaxThreads
# if possible.
# WARNING: you shouldn't increase this too much to avoid running out of file
#  descriptors, the following condition should hold:
#  MaxThreads*MaxRecursion + MaxQueue - MaxThreads  + 6 < RLIMIT_NOFILE
#  (usual max for RLIMIT_NOFILE is 1024)
# 
# Default: 100
#MaxQueue 200

# This option specifies how long (in seconds) the process should wait
# for a new job.
# Default: 30
#IdleTimeout 60

# Don't scan files/directories whose names match the provided
# regular expression. This option can be specified multiple times.
# Default: disabled
#ExcludePath ^/proc/
#ExcludePath ^/sys/

# Maximum depth the directories are scanned at.
# Default: 15
#MaxDirectoryRecursion 15

# Follow directory symlinks.
# Default: no
#FollowDirectorySymlinks no

# Follow symlinks to regular files.
# Default: no
#FollowFileSymlinks no

# Scan files and directories on other filesystems.
# Default: yes
#CrossFilesystems yes

# This option specifies the time intervals (in seconds) in which clamd
# should perform a database check.
# Default: 600
#SelfCheck 600

# Enable non-blocking (multi-threaded/concurrent) database reloads. This feature 
# will temporarily load a second scanning engine while scanning continues using 
# the first engine. Once loaded, the new engine takes over. The old engine is 
# removed as soon as all scans using the old engine have completed. This feature 
# requires more RAM, so this option is provided in case users are willing to 
# block scans during reload in exchange for lower RAM requirements.
# Default: yes
#ConcurrentDatabaseReload yes

# This option allows you to disable clamd's caching feature.
# Default: no
#DisableCache no

# Execute a command when virus is found.
# Use the following environment variables to identify the file and virus names:
# - $CLAM_VIRUSEVENT_FILENAME
# - $CLAM_VIRUSEVENT_VIRUSNAME
# In the command string, '%v' will also be replaced with the virus name.
# Note: The '%f' filename format character has been disabled and will no longer
# be replaced with the file name, due to command injection security concerns.
# Use the 'CLAM_VIRUSEVENT_FILENAME' environment variable instead.
# For the same reason, you should NOT use the environment variables in the
# command directly, but should use it carefully from your executed script.
# Default: disabled
#VirusEvent /opt/send_virus_alert_sms.sh

# Stop the daemon when libclamav reports an out of memory condition.
# Default: no
#ExitOnOOM yes

# Permit use of the ALLMATCHSCAN command.
# Default: yes
#AllowAllMatchScan yes

# Don't fork into background.
# Default: no
#Foreground no

# Enable debug messages in libclamav.
# Default: no
#Debug no

# Don't remove temporary files (for debugging purposes).
# Default: no
#LeaveTemporaryFiles no

# Record metadata about the file being scanned.
# Scan metadata is useful for file analysis purposes and for debugging scan behavior.
# The JSON metadata will be printed after the scan is complete if Debug is enabled.
# A metadata.json file will be written to the scan temp directory if LeaveTemporaryFiles is enabled.
# Default: no
#GenerateMetadataJson no

# Run the daemon as a specified user (the process must be started by root).
# Default: disabled
#User clamav

# With this option enabled ClamAV will load bytecode from the database. It is highly recommended you keep this option on, otherwise you'll miss detections for many new viruses.
# Default: yes
#Bytecode yes

# Set bytecode security level.
# Possible values:
# 	TrustSigned - trust bytecode loaded from signed .c[lv]d files,
# 		 insert runtime safety checks for bytecode loaded from other sources
# 	Paranoid - don't trust any bytecode, insert runtime checks for all
# Recommended: TrustSigned, because bytecode in .cvd files already has these checks.
# Default: TrustSigned
#BytecodeSecurity TrustSigned

# Set bytecode timeout in milliseconds.
# Default: 10000
#BytecodeTimeout 10000

# Allow loading bytecode from outside digitally signed .c[lv]d files.
# Default: no
#BytecodeUnsigned no

# Set bytecode execution mode.
# Possible values:
# 	Auto - automatically choose JIT if possible, fallback to interpreter
# ForceJIT - always choose JIT, fail if not possible
# ForceInterpreter - always choose interpreter
# Test - run with both JIT and interpreter and compare results. Make all failures fatal.
# Default: Auto
#BytecodeMode Auto

# Detect Potentially Unwanted Applications.
# Default: no
#DetectPUA yes

# Exclude a specific PUA category. This directive can be used multiple times.
# See https://docs.clamav.net/faq/faq-pua.html for the complete list of PUA
# categories.
# Default: disabled
#ExcludePUA NetTool
#ExcludePUA PWTool

# Only include a specific PUA category. This directive can be used multiple
# times.
# Default: disabled
#IncludePUA Spy
#IncludePUA Scanner
#IncludePUA RAT

# PE stands for Portable Executable - it's an executable file format used
# in all 32- and 64-bit versions of Windows operating systems. This option
# allows ClamAV to perform a deeper analysis of executable files and it's also
# required for decompression of popular executable packers such as UPX or FSG.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
#ScanPE yes

# Executable and Linking Format is a standard format for UN*X executables.
# This option allows you to control the scanning of ELF files.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
#ScanELF yes

# Enable the built in email scanner.
# If you turn off this option, the original files will still be scanned, but
# without parsing individual messages/attachments.
# Default: yes
#ScanMail yes

# Scan RFC1341 messages split over many emails. You will need to
# periodically clean up $TemporaryDirectory/clamav-partial directory.
# WARNING: This option may open your system to a DoS attack. Please don't use
# this feature on highly loaded servers.
# Default: no
#ScanPartialMessages no

# With this option enabled ClamAV will try to detect phishing attempts by using
# signatures.
# Default: yes
#PhishingSignatures yes

# Scan URLs found in mails for phishing attempts using heuristics.
# Default: yes
#PhishingScanURLs yes

# In some cases (eg. complex malware, exploits in graphic files, and others),
# ClamAV uses special algorithms to provide accurate detection. This option
# controls the algorithmic detection.
# Default: yes
#HeuristicAlerts yes

# Allow heuristic match to take precedence.
# When enabled, if a heuristic scan (such as phishingScan) detects
# a possible virus/phish it will stop scan immediately. Recommended, saves CPU
# scan-time.
# When disabled, virus/phish detected by heuristic scans will be reported only
# at the end of a scan. If an archive contains both a heuristically detected
# virus/phish, and a real malware, the real malware will be reported.
# Keep this disabled if you intend to handle "Heuristics.*" viruses
# differently from "real" malware.
# If a non-heuristically-detected virus (signature-based) is found first,
# the scan is interrupted immediately, regardless of this config option.
# Default: no
#HeuristicScanPrecedence yes

# Enable the Data Loss Prevention module.
# Default: no
#StructuredDataDetection no

# This option sets the lowest number of Credit Card numbers found in a file
# to generate a detect.
# Default: 3
#StructuredMinCreditCardCount 5

# This option sets the lowest number of Social Security Numbers found
# in a file to generate a detect.
# Default: 3
#StructuredMinSSNCount 5

# With this option enabled the DLP module will search for valid
# SSNs formatted as xxx-yy-zzzz.
# Default: yes
#StructuredSSNFormatNormal yes

# With this option enabled the DLP module will search for valid
# SSNs formatted as xxxyyzzzz
# Default: no
#StructuredSSNFormatStripped no

# Perform HTML/JavaScript/ScriptEncoder normalisation and decryption.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
#ScanHTML yes

# This option enables scanning of OLE2 files, such as Microsoft Office
# documents and .msi files.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
#ScanOLE2 yes

# With this option enabled clamav will try to detect broken executables
# (PE, ELF, & Mach-O) and alert on them with a Broken.Executable heuristic signature.
# Default: no
#AlertBrokenExecutables yes

# With this option enabled clamav will try to detect broken media files
# (JPEG, TIFF, PNG, GIF) and alert on them with a Broken.Media heuristic signature.
# Default: no
#AlertBrokenMedia yes

# Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).
# Default: no
#AlertEncrypted no

# With this option enabled the DLP module will search for valid Credit Card
# numbers only. Debit and Private Label cards will not be searched.
# Default: no
#StructuredCCOnly no

# Alert on encrypted archives (encrypted .zip, .7zip, .rar).
# Default: no
#AlertEncryptedArchive no

# Alert on encrypted documents (encrypted .pdf).
# Default: no
#AlertEncryptedDoc no

# With this option enabled OLE2 files with VBA macros, which were not
# detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros".
# Default: no
#AlertOLE2Macros no

# Alert on SSL mismatches in URLs, even if they're not in the database.
# This feature can lead to false positives.
# Default: no
#AlertPhishingSSLMismatch 

# Alert on cloaked URLs, even if they're not in the database.
# This feature can lead to false positives.
# Default: no
#AlertPhishingCloak no

# Alert on raw DMG image files containing partition intersections.
# Default: no
#AlertPartitionIntersection yes

# This option enables scanning within PDF files.
# If you turn off this option, the original files will still be scanned, but
# without decoding and additional processing.
# Default: yes
#ScanPDF yes

# This option enables scanning within SWF files.
# If you turn off this option, the original files will still be scanned, but
# without decoding and additional processing.
# Default: yes
#ScanSWF yes

# This option enables scanning xml-based document files supported by libclamav.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
#ScanXMLDOCS yes

# This option enables scanning HWP3 files.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
#ScanHWP3 yes

# This option enables scanning OneNote files.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
#ScanOneNote yes

# Scan within archives and compressed files.
# If you turn off this option, the original files will still be scanned, but
# without unpacking and additional processing.
# Default: yes
#ScanArchive yes

# This option enables scanning of image (graphics).
# If you turn off this option, the original files will still be scanned, but without additional processing.
# Default: yes
#ScanImage yes

# This option enables detection by calculating a fuzzy hash of image (graphics)
# files
# Signatures using image fuzzy hashes typically match files and documents by
# identifying images embedded or attached to those files.
# If you turn off this option, then some files may no longer be detected.
# Default: yes
#ScanImageFuzzyHash yes

# This option causes memory or nested map scans to dump the content to disk.
# If you turn on this option, more data is written to disk and is available
# when the leave-temps option is enabled at the cost of more disk writes.
# Default: no
#ForceToDisk no

# This option sets the maximum amount of time a scan may take to complete.
# The value of 0 disables the limit.
# WARNING: disabling this limit or setting it too high may result allow scanning
# of certain files to lock up the scanning process/threads resulting in a Denial of Service.
# The value is in milliseconds.
# Default: 0
#MaxScanTime 120000

# This option sets the maximum amount of data to be scanned for each input file.
# Archives and other containers are recursively extracted and scanned up to this
# value.
# The value of 0 disables the limit.
# WARNING: disabling this limit or setting it too high may result in severe
# damage.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 419430400
#MaxScanSize 400M

# Files/messages larger than this limit won't be scanned. Affects the input
# file itself as well as files contained inside it (when the input file is
# an archive, a document or some other kind of container).
# The value of 0 disables the limit.
# WARNING: disabling this limit or setting it too high may result in severe
# damage to the system.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 104857600
#MaxFileSize 100M

# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
# file, all files within it will also be scanned. This option specifies how
# deeply the process should be continued.
# The value of 0 disables the limit.
# WARNING: disabling this limit or setting it too high may result in severe
# damage to the system.
# Default: 17
#MaxRecursion 17

# Number of files to be scanned within an archive, a document, or any other
# container file.
# The value of 0 disables the limit.
# WARNING: disabling this limit or setting it too high may result in severe
# damage to the system.
# Default: 10000
#MaxFiles 10000

# This option sets the maximum size of a file to check for embedded PE.
# Files larger than this value will skip the additional analysis step.
# Negative values are not allowed.
# WARNING: setting this limit too high may result in severe damage or impact performance.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 41943040
#MaxEmbeddedPE 40M

# This option sets the maximum size of a HTML file to normalize.
# HTML files larger than this value will not be normalized or scanned.
# Negative values are not allowed.
# WARNING: setting this limit too high may result in severe damage or impact performance.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 41943040
#MaxHTMLNormalize 40M

# This option sets the maximum size of a normalized HTML file to scan.
# HTML files larger than this value after normalization will not be scanned.
# Negative values are not allowed.
# WARNING: setting this limit too high may result in severe damage or impact performance.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 8388608
#MaxHTMLNoTags 8M

# This option sets the maximum size of a script file to normalize.
# Script content larger than this value will not be normalized or scanned.
# Negative values are not allowed.
# WARNING: setting this limit too high may result in severe damage or impact performance.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 20971520
#MaxScriptNormalize 20M

# This option sets the maximum size of a ZIP file to reanalyze type recognition.
# ZIP files larger than this value will skip the step to potentially reanalyze as PE.
# Negative values are not allowed.
# WARNING: setting this limit too high may result in severe damage or impact performance.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 1048576
#MaxZipTypeRcg 1M

# This option sets the maximum number of partitions of a raw disk image to be scanned.
# Raw disk images with more partitions than this value will have up to the value number partitions scanned.
# Negative values are not allowed.
# WARNING: setting this limit too high may result in severe damage or impact performance.
# Default: 50
#MaxPartitions 128

# This option sets the maximum number of icons within a PE to be scanned.
# PE files with more icons than this value will have up to the value number icons scanned.
# Negative values are not allowed.
# WARNING: setting this limit too high may result in severe damage or impact performance.
# Default: 100
#MaxIconsPE 100

# This option sets the maximum recursive calls to HWP3 parsing function.
# HWP3 files using more than this limit will be terminated and alert the user.
# Scans will be unable to scan any HWP3 attachments if the recursive limit is reached.
# Negative values are not allowed.
# WARNING: setting this limit too high may result in severe damage or impact performance.
# Default: 16
#MaxRecHWP3 16

# This option sets the maximum calls to the PCRE match function during an instance of regex matching.
# Instances using more than this limit will be terminated and alert the user but the scan will continue.
# For more information on match_limit, see the PCRE documentation.
# Negative values are not allowed.
# WARNING: setting this limit too high may severely impact performance.
# Default: 100000
#PCREMatchLimit 100000

# This option sets the maximum recursive calls to the PCRE match function during an instance of regex matching.
# Instances using more than this limit will be terminated and alert the user but the scan will continue.
# For more information on match_limit_recursion, see the PCRE documentation.
# Negative values are not allowed and values > PCREMatchLimit are superfluous.
# WARNING: setting this limit too high may severely impact performance.
# Default: 2000
#PCRERecMatchLimit 5000

# This option sets the maximum filesize for which PCRE subsigs will be executed.
# Files exceeding this limit will not have PCRE subsigs executed unless a subsig is encompassed to a smaller buffer.
# Negative values are not allowed.
# Setting this value to zero disables the limit.
# WARNING: setting this limit too high or disabling it may severely impact performance.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 104857600
#PCREMaxFileSize 100M

# This option specifies a directory or mount point which should be scanned on access. The mount point specified, or the mount point containing the specified directory will be watched, but only notifications will occur. If any directories are specified, this option will preempt the DDD system. It can also be used multiple times.
# Default: disabled
#OnAccessMountPath /
#OnAccessMountPath /home/user

# This option specifies a directory (including all files and directories
# inside it), which should be scanned on access. This option can
# be used multiple times.
# Default: disabled
#OnAccessIncludePath /home
#OnAccessIncludePath /students

# This option allows excluding directories from on-access scanning. It can
# be used multiple times. Only works with DDD system.
# Default: disabled
#OnAccessExcludePath /home/bofh
#OnAccessExcludePath /root

# Use this option to exclude the root UID (0) and allow any processes run under root to access all watched files without triggering scans.
# Default: disabled
#OnAccessExcludeRootUID no

# With this option you can exclude specific UIDs. Processes with these UIDs
# will be able to access all files.
# This option can be used multiple times (one per line). Using a value of 0 on any line will disable this option entirely. To exclude the root UID please enable the OnAccessExcludeRootUID option.
# Default: disabled
#OnAccessExcludeUID 0

# This option allows exclusions via user names when using the on-access scanning client. It can
# be used multiple times.
# Default: disabled
#OnAccessExcludeUname clamuser

# Files larger than this value will not be scanned in on access.
# You may use 'G' or 'g' for gigabytes (1G = 1g = 1,073,741,824 bytes)
# 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 5242880
#OnAccessMaxFileSize 5M

# This option toggles the dynamic directory determination system for on-access scanning (Linux only).
# Default: no
#OnAccessDisableDDD no

# This option changes fanotify behavior to prevent access attempts on malicious files instead of simply notifying the user (On Access scan only).
# Default: no
#OnAccessPrevention yes

# Enables extra scanning and notification after catching certain inotify events. Only works with the DDD system enabled.
# Default: no
#OnAccessExtraScanning yes

# Max amount of time (in milliseconds) that the OnAccess client should spend for every connect, send, and receive attempt when communicating with clamd via curl (5s default)
# Default: 5000
#OnAccessCurlTimeout 10000L

# Max number of scanning threads to allocate to the OnAccess thread pool at startup--these threads are the ones responsible for creating a connection with the daemon and kicking off scanning after an event has been processed. To prevent clamonacc from consuming all clamd's resources keep this lower than clamd's max threads. Default is 5
# Default: 5
#OnAccessMaxThreads 10

# Number of times the OnAccess client will retry a failed scan due to connection problems (or other issues). Defaults to no retries.
# Default: 0
#OnAccessRetryAttempts 3

# When using prevention, if this option is turned on, any errors that occur during scanning will result in the event attempt being denied. This could potentially lead to unwanted system behaviour with certain configurations, so the client defaults to off and allowing access events in case of error.
# Default: no
#OnAccessDenyOnError yes

# Disable authenticode certificate chain verification in PE files.
# Default: no
#DisableCertCheck no

# Deprecated option to enable heuristic alerts (e.g. "Heuristics.<sig name>")
# Default: yes
#AlgorithmicDetection no

# 
# Default: no
#BlockMax 

# Deprecated option to alert on SSL mismatches in URLs, even if they're not in the database.
# This feature can lead to false positives.
# Default: no
#PhishingAlwaysBlockSSLMismatch no

# Deprecated option to alert on cloaked URLs, even if they're not in the database.
# This feature can lead to false positives.
# Default: no
#PhishingAlwaysBlockCloak no

# Deprecated option to alert on raw DMG image files containing partition intersections.
# Default: no
#PartitionIntersection no

# With this option enabled OLE2 files with VBA macros, which were not
# detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros".
# Default: no
#OLE2BlockMacros no

# Deprecated option to alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).
# Default: no
#ArchiveBlockEncrypted no

# ── Active (non-default) settings ──────────────────────────────────────────────

# Timestamp every log entry so events can be correlated with system logs.
# Default: no
LogTime yes

# Include file size and MD5/SHA hashes in threat reports — useful for
# submitting false-positive or false-negative reports to ClamAV.
ExtendedDetectionInfo yes

# Drop privileges to the 'clamav' system user after startup.
# clamd must be started as root for this directive to take effect.
# Default: don't drop privileges
User clamav

# Exclude file-access events triggered by the clamav user itself from
# on-access scanning — prevents the scanner from re-scanning its own reads
# and entering an infinite loop.
OnAccessExcludeUname clamav

# Watch the entire filesystem for on-access events via fanotify.
# Note: OnAccessPrevention cannot block events at the mount-point level,
# only when using OnAccessIncludePath (see comment below).
# Set the mount point where to recursively perform the scan,
# this could be every path or multiple path (one line for path)
OnAccessMountPath /

# Alternatively, add some directories instead of mount points
# OnAccessIncludePath /home

# Prevention doesn't work with OnAccessMountPath.
# It works with OnAccessIncludePath, as long as /usr and /etc are not included.
# Including /var while activating prevention is also not recommended, because
# this would slow down package installation by a factor of 1000.
#
# Prevention is disabled here because OnAccessMountPath / is used;
# enabling it with a full-filesystem mount path causes severe slowdowns.
OnAccessPrevention no

# Also trigger scans on inotify events (create/move/rename) in addition to
# open events — catches malware dropped by scripts without being read first.
# Perform scans on newly created, moved, or renamed files
OnAccessExtraScanning yes

# Optionallyexclude root-owned processes
# OnAccessExcludeRootUID true

# Raise the default recursion cap (15) to handle deeply nested archives or
# directory trees; set high deliberately for comprehensive scanning.
# Maximum depth directories are scanned at.
# Default: 15
MaxDirectoryRecursion 200

# TCP socket commented out here — the active TCPSocket/TCPAddr declarations
# appear earlier in this file (generated section).
#TCPAddr localhost
#TCPSocket 3310

# ── Enable all major scan categories ───────────────────────────────────────────
# Each directive below enables a specific scanner module.  All default to "yes"
# in recent ClamAV, but are listed explicitly to document intent and prevent
# a future default change from silently disabling a scanner.

DetectPUA yes           # Detect Potentially Unwanted Applications (adware, tools)
HeuristicAlerts yes     # Enable heuristic (behavior-based) detection algorithms
ScanPE yes              # Scan Windows PE executables (required for UPX/FSG decompression)
ScanELF yes             # Scan Linux ELF executables
ScanOLE2 yes            # Scan Microsoft Office documents and MSI files
ScanPDF yes             # Decode and scan PDF files
ScanSWF yes             # Scan Adobe Flash (SWF) files
ScanXMLDOCS yes         # Scan XML-based document formats (docx, xlsx, etc.)
ScanHWP3 yes            # Scan Korean HWP3 word-processor files
ScanOneNote yes         # Scan Microsoft OneNote files
ScanMail yes            # Parse and scan email messages (RFC 822/MIME)
ScanHTML yes            # Normalize and scan HTML/JavaScript
ScanArchive yes         # Unpack and scan inside ZIP, RAR, TAR, etc.
Bytecode yes            # Execute ClamAV bytecode signatures (required for many modern detections)
AlertBrokenExecutables yes  # Flag malformed PE/ELF files (often indicate deliberate obfuscation)
AlertBrokenMedia yes        # Flag malformed images used to exploit media parsers
AlertEncrypted yes          # Alert on any encrypted container
AlertEncryptedArchive yes   # Alert specifically on encrypted ZIP/7z/RAR
AlertEncryptedDoc yes       # Alert specifically on password-protected PDFs
AlertOLE2Macros yes         # Alert on Office files containing VBA macros
AlertPartitionIntersection yes  # Flag raw disk images with overlapping partitions

# Script to execute when a virus is detected.
# See /etc/clamav/virus-event.bash for the notification/logging logic.
# The script receives CLAM_VIRUSEVENT_FILENAME and CLAM_VIRUSEVENT_VIRUSNAME
# as environment variables (NOT via %f/%v — those were disabled for security).
VirusEvent /etc/clamav/virus-event.bash
