#
#  AVIRA avscan configuration file
#

# This configuration file allows you to set the specific options of the  
# command-line scanner (avscan). For setting Guard daemon options see 
# avguard.conf file. Remember that some options may be only specified 
# from command-line; see: avscan --help for such options.


# BatchMode [yes|no]
# If you enable this option avscan will enter the non-interactive batch
# mode. In this mode all decisions are carried out based on the given
# configuration file and command-line settings. The user will not be asked
# to make or confirm any decisions.
# This setting corresponds with the command-line option --batch.
# By default, BatchMode is disabled.
# BatchMode no

# RepairConcerningFiles 
# If you uncomment this option scanner will try to remove the problem 
# from the file being accessed. If this is successfully done, access will 
# be granted. If it fails, file access will be blocked. 
# By default, repairing is not enabled.
# RepairConcerningFiles

# AlertAction [none|ren|del|quarantine]
# Once a malicious file was detected, access to it is blocked by default 
# and the event is logged.
# This option allows you to specify an additional action to be followed for 
# the concerning file. 
# NOTE: If you set AlertAction to "quarantine" you need to define a quarantine 
# directory.
# The following alert actions are available:
# "none", "ignore": perform no additional action
# "rename", "ren" : rename the concerning file by appending a ".XXX" suffix
# "delete", "del" : delete the concerning file
# "quarantine"    : move the concerning file into quarantine dir
# Default: AlertAction none

# QuarantineDirectory [path]
# NOTE: if the specified directory does not exist it will be created by
# the guard. 
QuarantineDirectory /home/quarantine

# ExcludePattern [regex]
# This option allows you to specify files/directories that should be
# excluded in on-demand scans; you can use ExcludePattern multiple times to
# specify more patterns to be matched. It takes a PCRE pattern; matches will
# not get scanned. No syntax check is done and no restriction is applied on
# the pattern specification, all that's required is that it compiles
# successfully as a Perl-compatible regular expression.
# Please take into account that filenames are normalized before the pattern
# match is applied; therefor parts of the pathname may also trigger an
# unwanted match if the expression is not written carefully.
# Default: ExcludePattern NONE

# ExcludeExt [list of file suffixes]
# This option allows you to specify file extensions that should be excluded
# in on-demand scans. It takes a colon separated list of file suffixes;
# matches within this list will not get scanned.
# Example:
# ExcludeExt exe
# ExcludeExt exe:com:zip:tar.bz2
# Default: ExcludeExt NONE

# FollowSymlink [yes|no]
# The option is used to toggle the behavior regarding symlink files. 
# Default: FollowSymlink yes

# TemporaryDirectory [path]
# NOTE: The temporary directory should reside in a filesystem location in 
# which at least 4GB free disk space is available.
# Directory where temporary files of avscan are written.
# Default: TemporaryDirectory /tmp

# ScanMode [all|smart|extlist]
# Scanner can skip some files from scanning if they match certain patterns.
# This will give an increase in overall performance but may allow some viruses
# to pass undetected.
# extlist: scans files according to their filename extension
# smart: detects which files to scan from their name/content
# all: scans all files regardless of their name or content
# Default: ScanMode smart

# ArchiveScan [yes|no]
# Activate/deactivate scanning within archive files. 
# Default: ArchiveScan yes

# MailboxScan [yes|no]
# Activate/deactivate scanning of mbox files.
# Default: MailboxScan yes

# ArchiveMaxSize [bytes|KB|MB|GB]
# If at least one file contained within the archive exceeds this value,
# the whole archive will be skipped from scanning.
# NOTE: this option supports only values below 4GB (at most 4294967294 bytes). 
# IMPORTANT: This option does not refer to the full size of the archive.
# A value of 0 means archives will be scanned regardless of the size of
# files contained within.
# The size can be specified in gigabytes (GB), megabytes (MB),
# kilobytes (KB) or bytes.
# Default: ArchiveMaxSize 1GB

# ArchiveMaxRecursion [int]
# The maximum level of recursion to follow when scanning archives.
# A value of 0 means no limit.
# Default: ArchiveMaxRecursion 20

# ArchiveMaxRatio [int]
# The maximum ratio between the packed and unpacked size of the archive.
# If the maximum level is attained while decompressing, the scanning of the 
# archive is skipped.
# A value of 0 means no limit.
# Default: ArchiveMaxRatio 150

# ArchiveMaxCount [int]
# The maximum number of files to be scanned per archive.
# If the archive contains ArchiveMaxCount files or more,
# all the remaining files are skipped from scanning.
# A value of 0 means all files will be scanned.
# Default: ArchiveMaxCount 0

# MaxReportsPerFile [int]
# The upper limit of messages that are issued per scanned file. Usually this
# only affects archive scans. This setting can be used to prevent the
# scanner from Denial Of Service attacks generated by crafted archives that
# otherwise would provoke millions of alerts.
# A value of 0 means to disable any limit.
# Default: MaxReportsPerFile 100

# SendSNMPTraps [yes|no]
# Defines whether SNMP traps should be sent when an on-demand scan is
# started or finished. Also notify about alerts and important warnings via
# SNMP.
# Default: SendSNMPTraps no

# SNMPVerbosityLevel [notice|information|warning|error|alert|snmp]
# Defines for which issues traps should be sent when files are scanned.
# Default: SNMPVerbosityLevel snmp

# SNMPRecipient [hostname/ip-address]
# Defines the recipient of the SNMP trap. Please specify an hostname or an
# ip-address to which the traps are sent.
# Default: SNMPRecipient localhost

# ExternalProgram  [command arguments] 
# Run an external program for each concerning file found. You may use 
# macros to pass as arguments for the program.
# %h - path to file (may contain spaces)
# %f - filename only (may contain spaces)
# %p - full name of file (%h/%f) (may contain spaces)
# %U - UID of file
# %G - GID of file
# %s - size of file
# %m - mode of file
# %De - event type
# %DF - device
# %Dp - operation PID
# %Du - operation UID
# %Df - operation flags
# %Dm - operation mode
# %Sn - name of alert
# %Sa - additional alert information
# %SU - alert URL
# Notes: The external program should be able to handle empty macro results.
#        Check your external program for correctness and keep in mind, that an
#        attacker might use crafted file names (containing spaces, commands, etc.)
#        for injecting arguments into your external program.
# Example:
# ExternalProgram /bin/sh /usr/lib/AntiVir/guard/popup_message.sh [%Sn] %p
# Default: ExternalProgram NONE

# LogFile [path]
# Concerning activity may also be logged to a specified file (in addition to syslog). 
# Example:
# LogFile /tmp/avscan.log
# WARNING: Make sure you have the proper permissions for writing in the 
# specified location
# Default: LogFile NONE

# SyslogFacility [facility]
# Regardless of the above configuration settings, AvScan will always log 
# important information using syslog. 
# This option sets the facility that is used to when logging to syslog.
# Valid settings are 'auth', 'authpriv', 'cron', 'daemon', 'kern', 'local0'
# up to 'local7', 'lpr', 'mail', 'news', 'syslog', 'user' and 'uucp'.
# Default: SyslogFacility user

# SyslogPriority [priority]
# The priority that is used to suppress messages when logging to syslog.
# Valid settings for priority are 'alert', 'error', 'warning', 'info' and
# 'debug'; also 'notice' is allowed as a synonym for 'info'.
# Default: SyslogPriority notice

# DetectPrefixes [spec]
#         where [spec] is a whitespace or colon separated list
#         of "<type>[=<bool>]" 
#         detection can be enabled/disabled with yes/no parameters respectively.
#
# This option allow for the detection of certain categories of software
# which are not viruses but might not be wanted. Here is a description of
# the categories.
# ADSPY: Software that displays advertising pop-ups or software that very
#        often without the user's consent sends user specific data to
#        third parties and might therefore be unwanted.
# APPL: The term APPL/ denotes an application of dubious origin or which
#       might be hazardous to use.
# BDC: Is the Control software for backdoors. Control software for
#      backdoors are generally harmless.
# DIAL: A Dial-Up program for connections that charge a fee. Its use might
#       lead to huge costs for the user.
# GAME: It concerns a game that causes no damage on your computer.
# HIDDENEXT: File has an executable file extension but hides it behind a
#            harmless one.
# JOKE: A harmless joke program is present as file.
# PCK: File has been compressed with an unusual runtime compression tool.
#      Please make sure that this file comes from a trustworthy source.
# PHISH: Faked Emails that are supposed to prompt the victim to reveal
#        confidential information such as user accounts, passwords or
#        online-banking data on certain websites.
# SPR: Software that maybe able to compromise the security of your system,
#      initiate unwanted program activities, damage your privacy or spy
#      out your user behaviour and might therefore be unwanted.
# ALLTYPES: This is a pseudo type to represent all available types.
DetectPrefixes adspy=yes appl=no bdc=yes dial=yes game=no hiddenext=yes joke=no pck=no phish=yes spr=no

# HeuristicLevel [0-3]
# AvScan is capable of using heuristics to determine if a file
# is malicious. This allows new or unknown malicious code to
# be detected before you have had a chance to perform an update.
# The level of heuristics deals with all types of files and
# can be set to a certain level of intensity (0-3). 0 means
# disabled and 3 means full intensity.
# Note: Be aware that setting the HeuristicsLevel too high could
#       result in false alerts.
# Default: HeuristicsLevel 1

# HeuristicsMacro [yes|no]
# HeuristicsMacro deals with macros in office documents. 
# Default: HeuristicsMacro yes

# GuiSupport  [yes|no]
# You need to enable this option if you want to use AVIRA Security Management Console (SMC)
# to manage avscan remotely. It allows avscan to report alert to AVIRA SMC.
# Default: GuiSupport no

# GuiCAFile [certificate_auth_path]
# The certificate authority file to be used in SMC communication.
GuiCAFile /usr/lib/AntiVir/guard/gui/cert/cacert.pem

# GuiCertFile [certificate_path]
# The certificate file to be used in SMC communication.
GuiCertFile /usr/lib/AntiVir/guard/gui/cert/server.pem

# GuiCertPass [password]
# The password for the SMC certificate file.
GuiCertPass antivir_default

