Updating Signature Databases - ClamAV Documentation
Description: An open source malware detection toolkit and antivirus engine.

## Keyboard shortcuts

Press `←` or `→` to navigate between chapters

Press `S` or `/` to search in the book

Press `?` to show this help

Press `Esc` to hide this help

# Signature Testing and Management

Table Of Contents

- Signature Testing and Management
  - FreshClam
  - SigTool
  - ClamBC
  - Next Steps
  - Create your own signatures

> Tip: The commands on Windows are generally the same, but you may need to add the `.exe` extension to run the ClamAV applications.

## FreshClam

Before you can start the ClamAV scanning engine (using either `clamd` or `clamscan`), you must first have ClamAV Virus Database (.cvd) file(s) installed in the appropriate location on your system.

The tool `freshclam` is used to download and update ClamAV’s official virus signature databases. While easy to use in its base configuration, `freshclam` does require a working `freshclam.conf` configuration file to run (the location of which can be passed in via command line if the default search location does not fit your needs).

Once you have a valid configuration file, you can invoke FreshClam with the following command:

    freshclam

By default, `freshclam` will then attempt to connect to ClamAV’s virus signature database distribution network. If no databases exist in the directory specified, `freshclam` will do a fresh download of the requested databases. Otherwise, `freshclam` will attempt to update existing databases, pairing them against downloaded cdiffs. If a database is found to be corrupted, it is not updated and instead replaced with a fresh download.

Of course, all this behavior–and more–can be changed to suit your needs by modifying `freshclam.conf` and/or using various command line options.

You can find more information about FreshClam with the commands:

Unix/Linux:

    freshclam --help

Or (Unix/Linux only):

    man freshclam

> Tip: Newer versions of FreshClam will create your database directory if it doesn’t already exist. Older versions won’t, and may fail unless you create it first.

> Important: It is common on Ubuntu after a fresh install to see the following error the first time you use ClamAV:

>     freshclam

>     freshclam: error while loading shared libraries: libclamav.so.7: cannot open shared object   file: No such file or directory

> You can fix this error by using `ldconfig` to rebuild the library search path.

>     sudo ldconfig

If you are having issues updating the signature databases with `freshclam`, please review the `freshclam` FAQ.

## SigTool

ClamAV provides `sigtool` as a command-line testing tool for assisting users in their efforts creating and working with virus signatures. While sigtool has many uses–including crafting signatures–of particular note, is sigtool’s ability to help users and analysts in determining if a file detected by libclamav’s virus signatures is a false positive.

This can be accomplished by using the command:

    sigtool --unpack=FILE

Where FILE points to your virus signature databases. Then, once `sigtool` has finished unpacking the database into the directory from which you ran the command, you can search for the offending signature name (provided either by `clamscan` scan reports or `clamd` logs). As an example:

    grep "Win.Test.EICAR" ./*

Or, do all that in one step with:

    sigtool --find="Win.Test.EICAR"

This should give you the offending signature(s) in question, which can then be included as part of your false positive report.

To learn more in depth information on how `sigtool` can be used to help create virus signatures and work with malicious (and non-malicious) files please reference the many online tutorials on the topic.

Otherwise, information on available sigtool functions can be easily referenced with:

    sigtool --help

Or (Unix/Linux only):

    man sigtool

## ClamBC

`clambc` is Clam Anti-Virus’ bytecode signature testing tool. It can be used to test newly crafted bytecode signatures or to help verify existing bytecode is executing against a sample as expected.

For more detailed help, please use:

    clambc --help

Or (Unix/Linux only):

    man clambc

## Next Steps

Now that you know more about FreshClam and tools to work with the signature databases, it’s time to run your first scan.

## Create your own signatures

There is a whole community of malware researchers and signature writers. If you’d like to learn how to craft your own signatures, you can!