I just switched from using Eset to Clamwin+Clam Sentinel on my old little sorta 2-core netbook

While it works, as long as the computer is doing anything or browsing clamscan pretty much keeps one core maxed at all times. Eset was a lot better optimized.

But I've noticed before that some projects run a few times faster on my computer if you set gcc to optimize for Atom, so it might be worthwhile to built an Atom optimized version.

Is the scanner in C or assembly? Would it help to build a version with different settings? Are there assembly language routines that would need to be hand optimized for Atom?

How would I try compiling an Atom version?

Or maybe this work is already done and this just as good as it gets. What's the status?

Welcome to ClamWin!

I will refer your post to the ClamWin developers. ClamWin is written in C++ with some Python dependencies. It is essentially the Clam AV for Linux code ported over to Windows with a GUI. Clam Sentinel (a separate project from ClamWin) is written in Delphi/Kylix.

Regards,

currently I doubt there is hand optimizable code, the build is already optimized for i686, perhaps the command line scanner is buildable with mingw using -mcpu -march and friend, but I doubt you'll find better performances

Let me suggest that you use a small(er) set of extensions for ClamWin and Clam Sentinel to scan--this might limit some processing time. Clam Sentinel has a default extension set of about 130, and ClamWin has an unlimited extension set by default.

I am currently using exe, dll, eml, htm, html, js, tmp, class, swf, zip, bat, cmd, ocx, inf, jar, vbs, rar, rtf, scr, pdf, doc, xls, ppt, lnk, pif, sys, bin, com, cpl, job, and url. These extenisons are listed in the order that I see them most used by malware, so you could pare it down a bit to just the first 10 or 20 and be fairly safe. You could also save time on ClamWin scheduled scans by not scanning the entire drive. Most malware will be in the Win/system32 (WOW for 64 bit models) and %appdata% folders--also memory sometimes.

Regards,

Well one problem is that it's important to scan everything in FireFox's cache and that's not a single directory anymore, it's a tree of directories named by hex numbers, with up to something like 4096 directories.

And those files don't have an extention afaik.

If setting the root of that directory as "Paths where all files will be scanned" without setting the subdirectories will make all those files scanned, then for the most part, I don't need a lot of other things scanned in real time. I mostly just want to stop dangerous web scripts.

Yes--you can set up a folder in Clam Sentinel where all files are scanned in real-time as they are added, copied, or modified. I do this for my malware test folder (C:\Virus Test\ and it works fine. It doesn't matter about ClamWin, since it scans only on-demand. Clam Sentinel uses a default set of about 130 extensions to scan.

Regards,

Is the "paths where all files will be scanned" recursive into subdirectories or not?

Because if it's not, then it's useless with firefox.

It is recursive--just put the slash after the folder name--like C:\Windows\System32\ . Do not use a period, of course.

Regards,