On Windows, sample configuration files are found in the ClamAV install directory under conf_examples. Copy them up one level so they're next to your other clamav files, and change the extension to remove the ".sample". Then edit each conf file and remove
the "Example" line. Once this is done, freshclam can be used to download the signature database and clamd may be started. If you're manually downloading the signature databases, you will need to drop them in the database directory. On Windows, the directory
is named "database".
Ok so assuming you've installed ClamAV and have obtained the signature database one way or another, you'll be able to run scans. To run a scan you have two options. Again, open a terminal or two to use the following progams:
- clamscan.exe:
- You can run clamscan against a file or directory to load the database and run an immediate scan. Loading the database takes a few moments, but after that it will scan the files quickly.
- clamd.exe + clamdscan.exe:
- You run clamd.exe to load the database, and then
- open a 2nd terminal to use clamdscan.exe to select files that clamd.exe will scan. This allows you to more quickly scan specific files so you don't have to load the database for each call to clamdscan.exe.
Running scans with ClamAV is a very manual process. Many users set up some sort of automation to perform both updates and scans on a schedule. ClamAV doesn't currently provide any mechanism for scan automation so it's up to you to select a tool to automate
scanning.
If you have any additional questions about how to use ClamAV, feel free to ask.
Regards,
Micah
Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.