[quote user="harkyman"]

looking into the default configuration of clamd.conf in the ./etc folder in the clamd installation, I saw that on Windows, clamd defaults to not using tcp/ip port for communication: it uses a socket instead.

Hi,

Can anyone tel me how to setup clamav. I've installed ClamAv: clamav-0.90.3-1.exe downloaded from http://www.sosdg.org/clamav-win32 or is this the wrong one?

Instaled in defautl dir c:\clamav-devel

Instaled Lukas' ClamWall 1.1.4

Here is the header of one of the passed emails:
Received: from spooler by mydomain.com (Mercury/32 v4.51); 17 Jun 2007 17:51:27 +0200
X-Envelope-To: <me@mydomain.com>
X-SPAMWALL: Passed through antiSPAM test by SpamHalter 4.3.1 on mydomain.com (236)
X-SPAMWALL: probability - 0.0%
X-SPAMWALL: Whitelisted
X-CLAMWALL: Passed through antiviral test by ClamWall 1.1.4 on mydomain.com (31637)
 

However this is a part of the cw logfile for the same message:

  20070617 175238.312 MG000019 From: <test@testdomain.com>
  20070617 175238.312 MG000019 To: me@mydomain.com
C 20070617 175308.921 MG000019 ClamD version:
C 20070617 175308.921 MG000019 ClamD started
C 20070617 175308.921 MG000019 FreshClam started
E 20070617 175310.000 MG000019 ClamD not responding!
_ 20070617 175310.015 MG000019 Done! (31700)

 I've tried several things like starting clamd manually/by clamwal to no avail.

I also tried the version downloaded at: http://hideout.ath.cx/clamav/ (instaler) 

Do i need to alter settings in some other file, and if so what?

 Thnx.

Marcel. 

[quote user="Viper-STWK"]Do i need to alter settings in some other file, and if so what?[/quote]

Have you setup the configuration files - clamd.conf and freshclam.conf ?  Lukas has a link to some sample configuarations on his clamwall page http://www.ararat.cz/eng/show.php?clamwall  Make sure they agree with the entries on Clamwall's ClamAV tab.

(As to which Clamav version to use, personally I prefer Nico's builds from hideout.ath.cx.)

I've been watching this thread hoping to find a solution to this problem.  I've experienced the same thing.  It seems like ClamWall does not get the ClamAV started.  I've turned on the log for ClamAV and it does not generate anything when ClamWall calls it.

 --------------------------------

I finally found the solution.

After installing ClamAV in it's default install directory, you must copy all of the files in the "bin" and "etc" folders from the default directory into a folder called ClamAV in the Mercury directory.  

[quote user="Eagle"] I finally found the solution.

After installing ClamAV in it's default install directory, you must copy all of the files in the "bin" and "etc" folders from the default directory into a folder called ClamAV in the Mercury directory.[/quote]

If you go to the Clamav tab in the Clamwall configuration you can set any directory to be the location of the Clamav installation.  It doesn't have to be Mercury\Clamav.

Just trying this pc and I get this in the logs:

D 20070622 110423.337 MG00000D AV test...
C 20070622 110433.441 MG00000D ClamD version:
C 20070622 110433.441 MG00000D ClamD started
C 20070622 110433.551 MG00000D FreshClam started
D 20070622 110434.543 MG00000D ClamD response:
E 20070622 110434.543 MG00000D ClamD not responding!
D 20070622 110434.543 MG00000D Ban test...
D 20070622 110434.543 MG00000D end tests
_ 20070622 110434.553 MG00000D Done! (11233)

My ClamWall.ini has this:

[ClamAV]
ClamIP=127.0.0.1
ClamPort=3310
ClamSelf=1
ClamDir=C:\MERCURY\ClamAV\

I have copied the files from bin to the above location and still get this.

The message headers suggest the mail has been scanned, but the logs show nothing.

I've installed this version: clamav-0.90.3-1.exe

 Any ideas ?

Thanks
 

I agree that the directory does not have to be named ClamAV under the Mercury directory.  But, I was trying to follow the ClamWall's documentation that are posted on http://www.ararat.cz/eng/show.php?clamwall.  The last paragraph says to do the following:

Nothing seemed to work, then I noticed it said, "must exist in this directory".  What I did to make it work was copy the "bin" directory and the "etc" (combined them) into the ClamAV directory under Mercury.  The program ClamAV, by default, was installed in a directory off the root and changing the tab in the ClamWall setup to point at this location did not work.  I even tried to install the program under the Mercury directory.

It seems that these files have to be in the same directory, at least that is the only way I've been able to get it to work.

In earlier attempts, I even tried to install the ClamAV under the Mercury directory, but did not combine the "bin" and "etc" directories into one.  That combining them into the same directory is what worked for me.

Then again, maybe it's related to the version of ClamAV that I'm using.  I'm using it from http://hideout.ath.cx/clamav/.

All I can say is it's working and I love it.

still not working for me.

Can anyone talk me through this ?
 

Are you sure that your clamd.exe works at all?  Try going to the clamav directory where the program is located using cmd.exe and run clamd.exe.  It should start and run normally.

Thanks I'll try that.

FWIW, using ClamAV/SOSDG I wasn't able to get clamd and freshclam to start up automatically when Mercury/32 loads either.  I have ClamAV/SOSDG installed in \clamav-devel and use a batch file to get everything going.  From the batch file I start clamd, then freshclam, then Mercury/32.  In the ClamWall configuration the ClamAV mode is set to External ClamAV daemon.  Most important is the need to make sure clamd will run manually, as was previously stated.  I struggled to get it working here.  I remember downloading .zip files and extracting the contents and not being able to get clamd to run (same log entries as you receive).  Clamd started co-operating once I downloaded clamav-0.90.3-1.exe from SOSDG.ORG and installed it.  BTW, I start clamd by executing the start-clamd.bat file included with ClamAV.

 --

Brian Fluet
 

Installed ClamAV from http://hideout.ath.cx/clamav/

Managed to get it working by manually running clamdscan.exe first.

Once this is running Mercury & ClamWall seem to work OK.

Is this right ??

Thanks 

Just curious.  I was having the same problems as above, BUT after fooling around in "cmd" I realized that the daemon itself wasn't running!  I'm using FireDaemon for Mercury/32, so I created a new entry and VOILA!  Runs as a hidden service which ClamWall calls as needed.

 One thing that wasn't clear from the start was the need to keep the daemon running at all times for the ClamWall to invoke it correctly.  I had incorrectly assumed that Mercury would invoke first the daemon then ClamWall.

Oh, well.  Live and learn.......

-Norm

I've noticed Clamd is using around 30MB resident memory, compared to BitDefender 8 using 1MB.

Is this normal for ClamD ?
 

I don't know about the memory.  But, I have done more work to figure out how to get ClamD started and to "keep" it running.

I downloaded ClamAV from http://hideout.ath.cx/clamav/ and did an install of ClamAV into it's default directory "C:\ClamAV".

I pointed ClamWall on the last tab in Mercury in the "ClamAV daemon location" to "C:\ClamAV".

I copied the two config files (clamd.conf and freshclam.conf) from the "C:\ClamAV\etc" directory into the "C:\ClamAV\bin" directory.

I manually start ClamD before starting Mercury.

I'm now able to start ClamWall and have it work correctly.  There seems to be a problem with not having the "conf" files in the same directory as ClamD.exe and FreshClam.exe.

Below is a copy from the ClamWall log.  It is now reporting the version level too.

  20070625 194713.765 MG00000F From: test@testdomain.com
  20070625 194713.765 MG00000F To: me@mydomain.com
C 20070625 194713.796 MG00000F ClamD version: ClamAV 0.90.3/3523/Mon Jun 25 08:30:33 2007
C 20070625 194713.796 MG00000F ClamD started
C 20070625 194713.796 MG00000F FreshClam started
_ 20070625 194713.937 MG00000F Done! (171)

How do you get freshclam to auto update ?

Is it possible to have email alerts sent if a virus is found. 

[quote user="tomt"] How do you get freshclam to auto update ?[/quote]

First alter freshclam.conf so that 'DatabaseDirectory' is the same as the setting in clamd.conf, and alter the first 'DatabaseMirror' line so that it points to your country code update site. (Mine is DatabaseMirror db.uk.clamav.net)

Then if you run freshclam.exe it should update the signatures.  Set it to run using your own schedule program like AT if you like.

Or, you could run freshclam with the -d switch, and it will load itself permanently and update at the frequency set in the .conf file in the line 'Checks' which defaults to 12 times a day.

[quote]Is it possible to have email alerts sent if a virus is found. [/quote]

Clamwall doesn't do that. I tried a script which parsed the quarantined files and emailed a notification (you could do similar with the log files), but I don't use it anymore.  Manually checking the log file is now sufficient for me.

Thanks :)

[quote user="tomt"]

Just trying this pc and I get this in the logs:

D 20070622 110423.337 MG00000D AV test...
C 20070622 110433.441 MG00000D ClamD version:
C 20070622 110433.441 MG00000D ClamD started
C 20070622 110433.551 MG00000D FreshClam started
D 20070622 110434.543 MG00000D ClamD response:
E 20070622 110434.543 MG00000D ClamD not responding!
D 20070622 110434.543 MG00000D Ban test...
D 20070622 110434.543 MG00000D end tests
_ 20070622 110434.553 MG00000D Done! (11233)

My ClamWall.ini has this:

[ClamAV]
ClamIP=127.0.0.1
ClamPort=3310
ClamSelf=1
ClamDir=C:\MERCURY\ClamAV\

I have copied the files from bin to the above location and still get this.

The message headers suggest the mail has been scanned, but the logs show nothing.

I've installed this version: clamav-0.90.3-1.exe

 Any ideas ?

Thanks
 

[/quote]

I just found out from Lucas that Clamwall control over the external programs may not work at all when running as a service.  Apparently this is true for NT Wrapper since I've tested that but I do not know if it's true for all service wrappers.  Apparently he's sending out the command but it does not start clamd.  This would answer a number of questions from people that were never able to get this to work.

Thanks for the information Thomas.  I looked at this some time ago and didn't think there was a problem when running as localsystem, but I have decided to migrate over to external control anyway.