Team, Sniffer Folks, Andy:
The ClamAID installer does handle the pthreads requirement for you. It does
wrap ClamD as a service, (from the w32.clamav.net port ) , as well as
wrapping freshclam.exe as a reoccurring service, and it finishes with a test
of the eicar file.
Older Port? Yes, again, you are correct. The port from ClamAV is old, and
so the warning (From executing the ClamAV scanner at the command line),
gives you a 36 out of 48 possible in your "upgrade score". ( Meaning, your
database is up to date, but you have an older clamd.exe. ) This will be
updated as soon as ClamAV releases a rebuild.
We felt that while we could use one of the other two ports that were out
there, people would be more comfortable using the .MSI that was issued from
ClamAV. Sadly, this MSI does have limitations, that we've hopefully
corrected. ( One of these is it fails to adjust the paths in data and
config resources, if you install in an alternative folder. ) Every document
we found said "Don't Change the Install Path!" Yet the ClamAV installer
offers you the choice to put it anywhere. The problem seems to be that the
Clamd.exe ignores its local config file if its installed somewhere other
than C:\ClamAV\ The workaround is to always include the command line
switch --config-file="" in all calls to clamdscan.exe or freshclam.exe.
ClamAID handles correcting thoses issues. It uses command line config
references for all calls from Declude or Icewarp, in order to enable you to
install it in a location other than C:\ClamAV\ We thought that was a good
upgrade just in itself. Let us know how it responds under fire.
Thanks,
Andrew Wallo
----- Original Message -----
From: "Andy Schmidt" <andy_schm...@hm-software.com>
To: "Message Sniffer Community" <sniffer@sortmonster.com>
Sent: Monday, February 02, 2009 1:20 PM
Subject: [sniffer] Crosspost: ClamAV for Window (Summary of what I had
posted last month on a different list)
Hi,
1. http://www.clamwin.com is essentially a GUI/desktop build. It's kept
current - but doesn't have ClamD. So no good!
2. http://hideout.ath.cx/clamav/ needs CHP
(http://www.commandline.co.uk/chp/) to run in the "background", but was
unable to run this ClamD as a "service".
3. http://w32.clamav.net/ (the "official" build) does have ClamD and can
use
the current signature files - BUT the build is 10 month old (whatever the
consequence of that might be). It can be made to work with Declude, using
a
little Jscript that I'm attaching.
a) Declude Configuration:
#ClamAV
SCANFILE1 c:\Windows\system32\cscript.exe //nologo
D:\CMDfiles\runClamAV.JS
VIRUSCODE1 1
REPORT1 FOUND
b) Schedule this hourly to get fetch signature updates:
freshclam --daemon-notify
The Jscript file trims off the trailing "\" that Declude uses (otherwise
ClamDScan exits with code "2", file/path not found) and generates a
Report.txt file that matches Declude's expected format.
It would be helpful if someone were to either take over the "official
builds" and bring the version up to date (and teaches ClamDScan to accept
paths with trailing backslashes).
Best Regards,
Andy
-----Original Message-----
From: Andy Schmidt [mailto:andy_schm...@hm-software.com]
Sent: Sunday, January 04, 2009 6:39 PM
Hi,
The official Win32 build seems to work just fine, ClamD service and all?
a) I downloaded and installed the MSI file
b) I downloaded the pthread DLL that it required
c) I confirmed that clamscan (the command line scanner) was working - it
was.
d) I confirmed that I could run clamd from the command line. The I used
clamdscan from a second command window to scan for eicar.com, but this
time
using the clamd instance - and it detected it instantly.
e) I installed clamd as a Window service:
"C:\Program Files\Windows Resource Kits\Tools\Instsrv.exe" "ClamAV ClamD"
"C:\Program Files\Windows Resource Kits\Tools\Srvany.exe"
Then added the necessary registry entry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClamAV
ClamD\Parameters]
"Application"="C:\\Program Files\\clamAV\\clamd.exe"
f) started the ClamAV ClamD service - and again confirmed with clamdscan
that it detected eicar beautifully.
Not sure if that helps anyone?
Best Regards,
Andy
--------------------------------------------------------------------------------
#############################################################
This message is sent to you because you are subscribed to
the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <sniffer-...@sortmonster.com>
To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com>
To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com>
Send administrative queries to <sniffer-requ...@sortmonster.com>
#############################################################
This message is sent to you because you are subscribed to
the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <sniffer-...@sortmonster.com>
To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com>
To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com>
Send administrative queries to <sniffer-requ...@sortmonster.com>
