https://sourceforge.net/p/c-icap/wiki/clamavtechnical/Recent changes to clamavtechnicalenWed, 27 Aug 2014 15:54:28 -0000https://sourceforge.net/p/c-icap/wiki/clamavtechnical/<div class="markdown_content"><h1 id="the-antivirus-virus_scan-service">The Antivirus (virus_scan) service</h1> <h2 id="web-objects-scanning-model">Web objects scanning model</h2> <p>Currently there are the following options for virus_scan service:</p> <ul> <li>c-icap can configured to wait for all the data of the downloaded object received, then c-icap scan it and if a virus found then a page which informs the user returned. Otherwise the dowloaded object sent as is to the user's web browser. You can define the maximum size of downloaded objects.</li> <li>c-icap can configured to sends only a small percentage of the incoming data (e.g. 1% of the incoming data) that it receives, to user's client. When all the data has been received, they are scanned for viruses. If a virus found, no more data are sent to the user's web browser (but attention! maybe the virus contained in the data which c-icap already sent to the user!). Otherwise the remaining data send to the client.</li> <li>c-icap can configured to use a "viralator like" mode (look here for real viralator). In this mode the c-icap sends to the user's web client messages about the progress of download. After the download completed it sends a message with the web location where the downloaded file stored. </li> </ul> <p>Someone can use a combination of previous modes.<br /> The "viralator like" mode has the disadvantage that when a download stops for a reason can not be resumed. The real viralator has not this problem because uses the wget downloader. However c-icap can recognize the file types looking in their contents. Viralator uses squid's redirector which decide for filetype using file extension (Maybe a redirector as a service in c-icap?).</p> <h2 id="antivirus-engines">Antivirus engines</h2> <p>The virus_scan service can work with multiple antivirus engines, which integrated to virus_scan service as external modules. Currently the following antivirus engines modules distributed with c-icap-service package:</p> <ul> <li>clamav, which uses the libclamav library</li> <li>clamd, which uses the clamav clamd daemon for scanning downloaded objects</li> </ul></div>chtsantiWed, 27 Aug 2014 15:54:28 -0000https://sourceforge.neta97193fb9733260f3239ac26abe3d7fac3ef8597