Hello!
The "sherpya" Clam port at oss.netfarm.it is very easy to build and use,
and there are only about 10 lines of code in 2 or 3 modules where you
need to add a "VirusName->" prefix before the actual name of the virus
so Declude can pick it up in the report file. I just mod the code and
recompile instead of trying to manipulate the report file.
I do not use any sort of installer. I just setup the conf files, spawn a
clamd process on startup, schedule a freshclam run periodically, and
point Declude to the clamdscan scanner. I also grab the MSRBL Images
spam database for use with Clam. The clamd/clamdscan combo are very
light and fast.
Take care!
John
On 4/28/2010 1:13 PM, Andy Schmidt wrote:
Generally, ClamD catches most viruses that AVG misses (during those times
when it actually runs), and McAfee catches the occasional virus that ClamD
misses. ClamD downloads updates automatically (using the FreshClam).
I found the http://oss.netfarm.it/clamav build very useful. I don't recall
any installation difficulty. It did have a successful installer and is able
to install itself as a service.
There is a .REG file that sets up a registry entry where the path is stored.
In their registry, I use the following:
[HKEY_LOCAL_MACHINE\SOFTWARE\ClamAV]
"ConfigDir"="C:\\Progra~1\\ClamAV\\conf"
"DataDir"="C:\\Progra~1\\ClamAV\\db"
For FreshClam.conf, I changed these parameters:
DatabaseDirectory "C:\Program Files\clamAV\db"
UpdateLogFile "C:\Program Files\clamAV\log\freshclam.log"
LogTime yes
For ClamD.conf, I changed these:
LogFile "C:\Program Files\clamAV\log\clamd.log"
LogTime yes
TemporaryDirectory C:\Temp
DatabaseDirectory "C:\Program Files\clamAV\db"
For the service, I removed the spaces from the path (not sure if this was
needed):
"C:\Progra~1\ClamAV\clamd.exe" --daemon
In Declude, you'd use:
#ClamAV
SCANFILE1 C:\Progra~1\ClamAV\ClamDScan.exe
VIRUSCODE1 1
Of course, that still leaves the problem of the virus report file. I had
contacted Declude and they said they would check if they can natively parse
the report file. For now I still use a simple script to reformat the Report
file to suit Declude.
ClamAV now has an official Windows build AND compiles under Visual Studio.
So, ideally, Declude would just integrate ClamAV as an internal scanner
instead of having to deal with all this command-line jazz.
Best Regards,
Andy
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael
Cummins
Sent: Wednesday, April 28, 2010 1:30 PM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] Internal Scanner - Nonfunctional?
What's the best way to look into using Clam as a second scanner?
I found this at ARM, does anyone else use this install aid?
http://www.armresearch.com/tools/arm/clamAID.jsp
What's your general opinion of Clam when compared to McAffee, or another
favorite scanner?
How do you update your Clam database files?
Thanks for the discussion and feedback!
-- Michael Cummins
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
