zolw@Wierszokleta:~$ telnet localhost 3310 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. SCAN /home/zolw/infected /home/zolw/infected/sobre.com: W32/Magistr.B FOUND Connection closed by foreign host.It always closes the connection when first virus is found. In the case of archives, the output is exactly the same like with normal files:
SCAN /home/zolw/Clam/test/test2.zip /home/zolw/Clam/test/test2.zip: ClamAV-Test-Signature FOUNDError messages are printed in the following format:
SCAN /no/such/file /no/such/file: Can't stat() the file ERRORand they can be easily parsed.
clamscan writes all messages (only help is written to stdout by default) to stderr. In some situations you may want to redirect it to stdout with -stdout. stdout in contrast to stderr is buffered, that's why clamscan flushes this buffer after each message, to prevent the creation of trashes on the output. During scanning it writes something like this:
/TEST/test: OK /TEST/Makefile: OK /TEST/getopt.c: OK /TEST/virfile: Phantom #1 FOUNDWhen a virus is found, its name is printed between filename: and FOUND.
As you can see, zip files inside the zip file were scanned. If a virus is found in the (compressed) archive, it's noticed with Infected Archive. Infected archives are not counted as infected files - just files in them are. After scanning you should see Scan summary (it may be disabled with -disable-summary. It looks like: