Does ClamWin evaluate/scan every new process that starts in Windows (e.g. by hooking the CreateSection API-call)? Or is it a filesystem scanner "only"?

At the moment, ClamWin is an on-demand scanner, which means you have to scan files manually (although there's an option to scan all files that are loaded into memory, but still on demand).

We are working on an on-access scanner which will scan each file before you open/access it. This should be available with release 1.0, but (before you ask), we don't have a set timeline for this release.

Theoretically, an on demand scanner like ClamWin should find the same malware that an on access scanner will--provided both scanners use the same database/techniques. On access scanners use some different techniques, however, since they must react more quickly to malware. Because of this, you should use ClamWin in conjunction with an on access scanner if your computer is in an environment subject to risk--such as heavy browsing at unknown Web sites or lots of file transfers.

With ClamWin you are getting the benefit of two different projects--the engine from the ClamAV project for Linux servers and the ClamWin project for Windows servers/desktops. Work is underway to adapt ClamWin more specifically for Windows.


Regards,

Okay, great news. Have you decided on how to achieve an on-access solution? Will you for instance hook the CreateSection API-call, or do you have any other strategy?

Take a look at:
https://wiki.clamwin.com/index.php/ClamWinD

Regards,

Thanks =)