ClamAV antivirus

consultorpc · Post by **consultorpc** » Wed Jul 07, 2004 9:12 pm

Has anyone tried ClamAV for Windows with mailenable? Is there any way to make them work together?

The URL is http://www.clamwin.net

ClamAV is a well know open source antivirus for UNIX.

MrByte · Post by **MrByte** » Wed Jul 07, 2004 9:14 pm

Does ClamAV now clean zipped attachment's? That had been an issue.

consultorpc · Post by **consultorpc** » Wed Jul 07, 2004 9:21 pm

I have not tried it yet but as their website:

command-line scanner
fast, multi-threaded daemon
milter interface for sendmail
database updater with support for digital signatures
virus scanner C library
on-access scanning (Linux and FreeBSD)
detection of over 20000 viruses, worms and trojans
built-in support for RAR (2.0), Zip, Gzip, Bzip2
built-in support for Mbox, Maildir and raw mail files

paarlberg · Post by **paarlberg** » Thu Jul 08, 2004 1:24 am

Running from the Command Line
ClamWin can be run from the command line, from a batch file for instance. For a full list of parameters, navigate to the directory containing the executable files

("C:\Program Files\ClamWin\bin" on a default istallation) and run
clamscan.exe --help

The directory must be specified, using the --database=FILE/DIR parameter. In a default installation, the command to scan the entire C: drive would be:
clamscan.exe --database="C:\Program Files\ClamWin\db" --recursive C:\

Note the use of the --recursive parameter to ensure that sub-directories are scanned.

When run from the command line, a value will be returned, indicating whether or not a virus was detected. If no virus is found, the return value will be 0. If a virus is found, the return value is 1. Any other return value indicates an error.

paarlberg · Post by **paarlberg** » Fri Jul 09, 2004 1:51 pm

The command line options are:

Code: Select all

C:\Program Files\ClamWin\bin>clamscan --help

                          Clam AntiVirus Scanner devel-20040517
                (C) 2002 - 2004 Tomasz Kojm <tkojm@clamav.net>

    --help                -h             Show help
    --version             -V             Print version number and exit
    --verbose             -v             Be verbose
    --debug                              Enable debug messages
    --quiet                              Be quiet - only output error messages
    --stdout                             Write to stdout instead of stderr
                                         (this help is always written to stdout)


    --tempdir=DIRECTORY                  create temporary files in DIRECTORY
    --database=FILE/DIR   -d FILE/DIR    Load virus database from FILE or load
                                         all .cvd and .db[2] files from DIR
    --log=FILE            -l FILE        Save scan report to FILE
    --recursive           -r             Scan directories recursively
    --infected            -i             Print infected files only
    --remove                             Remove infected files. Be careful.
    --move=DIRECTORY                     Move infected files into DIRECTORY
    --exclude=REGEX                      Don't scan file names matching REGEX
    --include=REGEX                      Only scan file names matching REGEX
    --bell                               Sound bell on virus detection
    --no-summary                         Disable summary at end of scanning
    --mbox                -m             Treat stdin as a mailbox

    --no-ole2                            Disable OLE2 support
    --no-archive                         Disable libclamav archive support
    --block-encrypted                    Block encrypted archives.
    --max-space=#n                       Extract first #n kilobytes only
    --max-files=#n                       Extract first #n files only
    --max-recursion=#n                   Maximal recursion level
    --unzip[=FULLPATH]                   Enable support for .zip files
    --unrar[=FULLPATH]                   Enable support for .rar files
    --unace[=FULLPATH]                   Enable support for .ace files
    --arj[=FULLPATH]                     Enable support for .arj files
    --unzoo[=FULLPATH]                   Enable support for .zoo files
    --lha[=FULLPATH]                     Enable support for .lha files
    --jar[=FULLPATH]                     Enable support for .jar files
    --tar[=FULLPATH]                     Enable support for .tar files
    --deb[=FULLPATH to ar]               Enable support for .deb files,
                                         implies --tgz , but doesn't conflict
                                         with --tgz=FULLPATH.
    --tgz[=FULLPATH]                     enable support for .tar.gz, .tgz files

Has anyone tried to configure it yet?

paarlberg · Post by **paarlberg** » Mon Jul 19, 2004 3:51 am

MartynK · Post by **MartynK** » Wed Jul 28, 2004 8:04 am

So has anyone actually tried this ?

consultorpc · Post by **consultorpc** » Wed Jul 28, 2004 8:12 am

Yes, at last I have it working. I had to tweak some registry values to make it work.

When I get some spare time I will release a How-To.

paarlberg · Post by **paarlberg** » Fri Sep 10, 2004 7:53 am

Any update?

MartynK · Post by **MartynK** » Sat Sep 11, 2004 2:06 am

Well here is my first go at this. I have been running it now for a few days infront of my normal scanners and it seems to be doing an OK job. I will say though that it is not the fastest of scanners to load and process.

The following is what I had to do to get it installed:

I am working on the basis that everything (including ME) is installed on the C: drive.

1. Download and install ClamWin (I used 0.35.2)
Available at http://www.clamwin.org
2. Install to "C:\Program Files\ClamWin"
3. Change the logfile to somewhere nice.
4. Create the directory "C:\Program Files\ClamWin\VirusDB" and change the ClamWin setting.
5. Download the latest virus defs using the program.
6. Import the registry file (enables ME to use the scanner).
Available at www.publicplanet.com\MEFilter\ClamWin\MEAVCLM.Zip
7. Add the entry "MEAVCLM" to the list of processing order.

Do this by using RegEdit and changing the key:

"HKLM\Software\Mail Enable\Mail Enable\Agents\MTA\Filters\Processing Order"

This is a comma seperated list, you can put it wherever you want.

8. Using the ME Administrator program configure any required options.
9. Restart the MTA process.
10. Press the "Test" button
No results should be returned in the window, but the message "Command line scanner returned: 1" should be at the bottom of the window.

And thats it.

MartynK · Post by **MartynK** » Sun Sep 12, 2004 2:03 pm

So has anyone given this a go yet.

It seems to be working quite well. I have not seen anything drop through to my secondary AV scanner yet.

MartynK · Post by **MartynK** » Mon Sep 13, 2004 12:14 pm

It has just be pointed out to me that step 7. should read

7. Add the entry "MEAVCLM" to the list of processing order.

Thanks "paarlberg" for the spot.

paarlberg · Post by **paarlberg** » Mon Sep 13, 2004 1:54 pm

Thanks Martyn...

So far 100% catch rate with ClamWin... I will just need to RTFM next time..

I am using the following AV in order..

ClamWin
F-Prot
AVG

You gotta like the price of ClamWin..

MartynK · Post by **MartynK** » Wed Sep 15, 2004 11:45 am

An Update:

Still seem to be getting a 100% hit rate with this AV scanner.

Both F-Prot and McAfee that I also use have not been called into action.

paarlberg · Post by **paarlberg** » Wed Sep 15, 2004 12:22 pm

I still have a 100% catch rate as well..