Mirroring the Virus Database
Luca Gibelli
17th September 2006
Some guidelines for people interested in contributing to the distribution of ClamAV
virus database.
1 Introduction
1.1 This doc
The latest version of this document is always available at http://www.clamav.net/doc/mirrors/.
Before going any further, please check that you are reading the latest version.
Japanese sysadmins can find a translated version of this doc at http://www.orange.co.jp/~masaki/clamav/mirror-
howto-jp.html (not necessarily up to date).
1.2 Who is responsible for the virus database
The virusdb team take care of reviewing virus signatures, checking for new viruses in
the wild and committing changes to the virus database file.
The updates are released quite often (usually no less than three times a week). If
you want to be notified whenever the virus database is updated subscribe to clamav-
virusdb at lists.clamav.net .
Every time the virusdb team updates the database, the ChangeLog will be posted
to the mailing-list.
Visit for the list description and archives.
If you need to contact the virusdb team please write to: virus-team at clamav.net
1.3 Virus submission
Whenever you find a new virus which is not detected by ClamAV you should send it
to the virusdb team by filling the form at http://www.clamav.net/sendvirus.html. They
1
will review your submission and update the database so that the whole ClamAV user
community can take benefit from it.
Never send virus samples to ClamAV mailing-lists or developers addresses.
1.4 Getting a copy of the latest virus database
The most important factor for an antivirus’s efficiency is to be up to date. ClamAV
comes with a tool to update the virus database automatically: its name is freshclam.
freshclam looks up the TXT record associated with current.cvd.clamav.net and ex-
tracts the latest database version available from the string returned. If the local database
is outdated, freshclam tries to connect to the hostnames listed in freshclam.conf (DatabaseMir-
ror directive). If the first server in the