ClamAV Guide - Part I : Setting Up ClamAV Anti-virus for ORF

Getting Started - Downloading Required Packages

1. Download the latest version of ClamAV (as of writing this, v0.95.3) from http://hideout.ath.cx/clamav/
2. Download the ClamAV External Agent definition for ORF (this is required to connect ORF and ClamAV). Extract the ZIP file to a directory.

Installing ClamAV for Windows

Extract and run the installer of ClamAV for Windows, it will guide you to the setup process.

WARNING: If you install ClamAV to any directory other than the default (C:\clamav), you will have to manually edit a few configuration files after installation (see below). To avoid this, we strongly recommend to install it to the default directory (C:\clamav).

Installing FreshClam

Freshclam is responsible for updating the official ClamAV virus signatures. To install freshclam as a Windows service, go to command prompt and run the following command from the ClamAV installation directory:

freshclam --install

Configuring and Starting FreshClam

1. Start the Services console (Start > Run > services.msc)
2. Right-click on ClamWin Free Antivirus Database Updater, select Properties.
3. Change the Startup type to Automatic (so it will start every time Windows starts)
4. 
5. Start the service, click Apply and OK.

IMPORTANT: You should run freshclam at least once to download the official signature files before proceeding with the installation of ClamD. If you have a 64-bit system, please read the notes below before running freshclam for the first time.

Installing ClamD

Clamd is the virus filtering server of ClamAV. Clients (like the clamdscan command-line tool that ORF uses as External Agent) connect to the clamd server to filter emails. Install clamd from command prompt by run the following command from the ClamAV installation directory:

clamd --install

Configuring and Starting ClamD

1. Start the Services console (Start > Run > services.msc)
2. Right click on ClamWin Free Antivirus Scanner Service, select Properties.
3. Change the Startup type to Automatic (so it will start every time Windows starts)
4. 
5. Start the service, click Apply and OK.

Importing the External Agent

ClamAV can be attached to ORF using External Agents. The External Agent definition you downloaded describes how ORF can work with ClamAV. Import this definition by following the steps below:

1. Start the ORF Administration Tool
2. Select Configuration | Import | External Agent definitions... from the main menu
3. Select the clamav.xml file from the definition pack you downloaded earlier and click Open
4. Click OK
5. Enable the new ClamAV for Windows agent.

To make sure the External Agents test is enabled and configured properly:

1. Expand Configuration / Tests / Tests in the left navigation tree
2. Check if the External Agent test is enabled. If it is not enabled, enable now
3. Expand Configuration / Filtering – On Arrival / External Agents in the left navigation tree
4. Make sure that Path for the temporary email files points to a valid and existing directory. This is where ORF will store a temporary copy of the email during testing. This can be any directory, just make sure to exclude it from any resident anti-virus filtering, otherwise your anti-virus product may remove/lock the file before it could be scanned.

The definition is shipped with a few defaults, you may want to review these:

1. Double-click the ClamAV for Windows agent in the list.
2. By default the agent is configured to drop emails on hit. If you want to tag or redirect them, click the Exit codes tab, then the Actions button and configure a different action.
3. When you are finished, click OK.
4. Save your settings to apply the changes by pressing Ctrl + S in the Administration Tool. If you have an older version (pre-4.3), restarting the ORF Service is also necessary to apply the changes: press Ctrl + U in this case instead.