View Source: ClamAV - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages

[ClamAV | http://www.clamav.net/] is a [Free] ([GPL]) [Virus] scanner for [Linux], [Solaris], [*BSD], [AIX], [MacOSX], [Cygwin] B20 on multiple architectures such as [Intel], [Alpha], [SPARC], Cobalt MIPS boxes, [PowerPC] and [RISC] 6000. It started as a [C]-based reimplementation of the abandoned [Java] ~OpenAntiVirus. Signature updates are available in an open FileFormat.

[ClamAV] comes with a tool called <tt>freshclam</tt> which updates the virus database automatically: it downloads the database from ~http://database.clamav.net/ (a round robin record that tries to equally balance the traffic between [all the database mirrors | http://www.clamav.net/mirrors.html]) which is split into two files called <tt>main.cvd</tt> and <tt>daily.cvd</tt>. <tt>daily.cvd</tt> is updated frequently and occasionally is merged with <tt>main.cvd</tt>.

In issue 8/2004 (April 5, 2004), the German computer magazine [c't | http://www.heise.de/ct/] published a comparative review of a number of virus scanners, in which they reported that [ClamAV]'s signature updates are provided far too slowly to adequately cope with the contemporary appearance rate of new mail worms, of which new mutations sometimes follow each other within hours. On the other hand, a lot of people appear to have had experiences to the contrary. That article also mentions that [ClamAV] lacks "code emulation", an easy way to identify variations of a PolyMorphicVirus.

Anyway, you can see [ClamAV]'s response times by yourself at [http://news.gmane.org/gmane.comp.security.virus.clamav.virusdb]. I suggest you check them out before you say [ClamAV] doesn't suit your needs. You could be surprised.

[ClamAV] can be used by [ContentScanner]s to scan [Email]s on many [MTA]s. The [ClamAV] package includes one written by Nigel Horne for SendMail called <tt>clamav-milter</tt>. Another one is [smtp-vilter | http://www.etc.msys.ch/software/smtp-vilter/]. They both use the SendMail "milter" [API].
Other [ContentScanner]s known to work with [ClamAV] are [Amavis / Amavis-ng | http://amavis.sf.net/], [AMaViS-New | http://www.ijs.si/software/amavisd/], [Exiscan | http://duncanthrax.net/exiscan-acl/], MailScanner, QmailScanner.

You can also use [ClamAV] to scan all [POP3] traffic with <tt>pop3vscan</tt>. See ClamAvPopVscan.

In fact you can even use [ClamAV] to scan your incoming mail in [Outlook]: just get [ClamWin | http://www.clamwin.com] and install the Outlook plugin! It is also a generic on-access scanner for [Windows].

!! User Wishlist

This wiki page doesn't get much attention. And it is not possible to let you know about you documentation for requested features that are actually already implemented. Therefore, please post your wishes on the [ClamAV] MailingList instead.

!! See also

* ClamAvNotes
* ClamAvPopVscan
* AntiVirus
* [Third-party software with ClamAV support | http://www.clamav.net/3rdparty.html]
* [ClamWin | http://www.clamwin.com]
* [ClamAV Homepage| http://www.clamav.net/]
* [Interview with ClamAV project founder Tomasz Kojm| http://www.emailbattles.com/archive/battles/virus_aabejfhaib_ag/]

9 pages link to ClamAV:

The following authors of this page have not agreed to the WlugWikiLicense. As such copyright to all content on this page is retained by the original authors.

ChrisLowth
GaetanoAndreaCallea

The following authors of this page have agreed to the WlugWikiLicense.

IanMcDonald

Last edited on Sunday, August 28, 2005 4:22:34 pm by "BjGillette"

Edit PageHistory Diff Info LikePages

PHP Warning