Virus database main.cvd uncompression

Question

In my previous question (Hexadecimal virus signatures database), I asked where I can get a hex virus signature database, and the answer was: ClamAV. So I downloaded the "main.cvd" database and was told that it was a compressed tar file. I have two questions to ask:

are the signatures in hex format (of course when uncompressed)?
how do I uncompress the "main.cvd" file to view its contents, do i just rename it to main.tar and then uncompress it?

score 4 · Accepted Answer · answered Feb 12 '11 at 16:57

4

I was able to do It by using a text editor and removing the first 512 bytes. Then renamed the file extension to .tar.gz and opened it using winrar

answered Feb 12 '11 at 16:57

Seif Shawkat

237
2
15

Thank you. Finally I was able to extract main.cvd database file. I renamed to .gz and extracted with 7zip.... :) – Keshan Fernando Oct 31 '16 at 05:07

score 2 · Answer 2 · answered Jun 24 '17 at 21:44

2

Run:

dd if=main.cvd of=clamav_main.tar.gz skip=1 bs=512
tar zxvf clamav_main.tar.gz
chmod 700 *

answered Jun 24 '17 at 21:44

Phil L.

2,637
1
17
11

is there a windows equivalent? – BigChief Dec 24 '21 at 20:16

score 0 · Answer 3 · answered Oct 01 '18 at 13:41

0

I have found this one-line set of commands to work nicely:

xxd -ps -s 512 <CVD-FILE> | xxd -r -ps | tar -zx

answered Oct 01 '18 at 13:41

bng44270

339
2
6

Virus database main.cvd uncompression

3 Answers3