Thanks John, Yes, that'll work too.
Of course, rather than you having to modify the source code of 2 or 3 modules for every build - or me having to write a report file parser, the REAL solution is for Declude to provide at least a minimum amount of flexibility in parsing report files (or - to integrate the ClamLib and eliminate any command line needs). Best Regards, Andy -----Original Message----- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Cert Sent: Wednesday, April 28, 2010 7:26 PM To: declude.virus@declude.com Subject: Re: [Declude.Virus] ClamAV Hello! The "sherpya" Clam port at oss.netfarm.it is very easy to build and use, and there are only about 10 lines of code in 2 or 3 modules where you need to add a "VirusName->" prefix before the actual name of the virus so Declude can pick it up in the report file. I just mod the code and recompile instead of trying to manipulate the report file. I do not use any sort of installer. I just setup the conf files, spawn a clamd process on startup, schedule a freshclam run periodically, and point Declude to the clamdscan scanner. I also grab the MSRBL Images spam database for use with Clam. The clamd/clamdscan combo are very light and fast. Take care! John On 4/28/2010 1:13 PM, Andy Schmidt wrote: > Generally, ClamD catches most viruses that AVG misses (during those times > when it actually runs), and McAfee catches the occasional virus that ClamD > misses. ClamD downloads updates automatically (using the FreshClam). > > > > I found the http://oss.netfarm.it/clamav build very useful. I don't recall > any installation difficulty. It did have a successful installer and is able > to install itself as a service. > > There is a .REG file that sets up a registry entry where the path is stored. > > > > In their registry, I use the following: > > > > [HKEY_LOCAL_MACHINE\SOFTWARE\ClamAV] > > "ConfigDir"="C:\\Progra~1\\ClamAV\\conf" > > "DataDir"="C:\\Progra~1\\ClamAV\\db" > > > > For FreshClam.conf, I changed these parameters: > > > > DatabaseDirectory "C:\Program Files\clamAV\db" > > UpdateLogFile "C:\Program Files\clamAV\log\freshclam.log" > > LogTime yes > > > > For ClamD.conf, I changed these: > > > > LogFile "C:\Program Files\clamAV\log\clamd.log" > > LogTime yes > > TemporaryDirectory C:\Temp > > DatabaseDirectory "C:\Program Files\clamAV\db" > > > > For the service, I removed the spaces from the path (not sure if this was > > needed): > > > > "C:\Progra~1\ClamAV\clamd.exe" --daemon > > > > In Declude, you'd use: > > > > #ClamAV > > SCANFILE1 C:\Progra~1\ClamAV\ClamDScan.exe > > VIRUSCODE1 1 > > > > Of course, that still leaves the problem of the virus report file. I had > contacted Declude and they said they would check if they can natively parse > the report file. For now I still use a simple script to reformat the Report > file to suit Declude. > > > > ClamAV now has an official Windows build AND compiles under Visual Studio. > So, ideally, Declude would just integrate ClamAV as an internal scanner > instead of having to deal with all this command-line jazz. > > > > Best Regards, > > Andy > > > > > > > > From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael > Cummins > Sent: Wednesday, April 28, 2010 1:30 PM > To: declude.virus@declude.com > Subject: RE: [Declude.Virus] Internal Scanner - Nonfunctional? > > > > What's the best way to look into using Clam as a second scanner? > > > > I found this at ARM, does anyone else use this install aid? > > > > http://www.armresearch.com/tools/arm/clamAID.jsp > > > > What's your general opinion of Clam when compared to McAffee, or another > favorite scanner? > > > > How do you update your Clam database files? > > > > Thanks for the discussion and feedback! > > > > -- Michael Cummins > > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to imail...@declude.com, and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
