hpn01 | hpn02

ClamAV Guide - Part II : Phishing, Scam and Spam Protection with ClamAV

Introduction - What Is This About?

This guide provides detailed instructions on configuring ClamAV for phising, scam and spam protection by using third-party ClamAV signatures. This is the second part of a two-part series – find the first part on the link below:

ClamAV Guide - Part I : Setting Up ClamAV Anti-virus for ORF

NOTE

Generally, the quality of third-party signatures is quite good, but your mileage may vary. If you are not sure what to expect, configure the ClamAV agent to tag or redirect emails on hit for a short testing period, so you can recover any falsely blacklisted emails.

1

Getting Started - Downloading Required Packages

Visit http://hideout.ath.cx/clamav/ and download the latest version of the following components:

  1. The latest ClamSup package (ZIP)
  2. Rsync for Windows (ZIP)

ClamSup is an add-on batch file that can update third-party signatures, while Rsync is used by ClamSup to download updates.

IMPORTANT: The communication protocol used by Rsync is TCP/873. Make sure this port is open on your firewall.

2

Installing ClamSup

Extract the contents of ClamSup.zip to the installation directory of ClamAV (C:\clamav by default). Replace existing files with the ones in the archive when prompted.

You can configure ClamSup signature sources by editing clamsup.ini. You will probably find the default signature set suitable, so we recommend to skip this step for now, and revisit this file once you familiarized yourself with ClamAV.

3

Installing Rsync

Extract the contents of rsync_w32.zip to the installation directory of ClamAV (C:\clamav by default). Replace existing files with the ones in the archive when prompted.

4

Scheduling updates

To schedule the update process, issue the following command from command-line:

schtasks /create /sc hourly /mo 1 /tn "ClamSup" /tr c:\clamav\ClamSup.bat /ru "NT AUTHORITY\SYSTEM"

This will add a scheduled task called ClamSup which will run ClamSup.bat under the SYSTEM account in every hour to update the default anti-virus signatures. If you would like to update more (or less) frequently, feel free to modify the command accordingly (see this link regarding the syntax).

5

Adding Further Signatures (Optional)

There are a lot of third-party signatures available for ClamAV to extend its filtering capabilities. Probably the most well-known are the signatures offered by Sanesecurity built against different threats. You can find more info about these at

http://www.sanesecurity.com/clamav/databases.htm

For more tips on fine-tuning ORF, read the Getting The Most Out of ORF Guide
Article by: Krisztián Fekete, Vamsoft Ltd.
Published: February 15, 2010

Questions? Comments? Contact our Technical Support