Hello everyone. I decided to join ClamWin but have been using this software sometime along with ClamSentinel. I talked with someone at Immunet who, I think, helped program/code ClamAV. I talked to him about supporting ClamAV, but I decided to join ClamWin instead because it seems to be better fit for windows users. I have limited time on my end, so I can only offer little right now. I will test out any open beta projects and submit unknown samples and false positives, if I run across any. If I do happen to get more time on my end, I will see if I can open up a direct connection line for a database link to your servers, I don't know if you are still looking for people who can do that, but when the time comes I will be willing. This is what I had original offered to Immunet, but I prefer open-source, so my assistance is yours.

To conclude, I have some questions to ask.

1. Is ClamWin a native 64-bit project like ClamAV is? If not, you should consider this in the near future. 64-bit systems are very popular now-a-days.

2. It has been sometime since this has been asked, and I know you have limited people and limited money, but when will ClamWin become a real-time antivirus?

3. I don't know if you guys are responsible for ClamSentinel, but I was wondering if you could change how ClamSentinel reports infections? Instead of having a pop-up notification, have a pop-up box offer selections of Ignore, Quarantine, Delete, or report as false positive with a direct link to submit false-positives. It is a much better idea then currently it is. Also the suspicious file detection should be changed to something similar.

4. How do I get the safebrowser.cvd to work with ClamWin or is it not possible now? I tried to manually add it then checked for updates but it deleted itself.

I can partially answer some of these.
1. ATM, there is no need to provide a 64-bit version of ClamWin, speed improvements would probably be insignificant, and it would use more memory.
2. I think they've been planning it for a long time, they just don't have the resources. A while ago I released a small program that would use ClamWin to scan files as they are opened, but it still needs a lot of work.
3. ClamSentinel is a separate project, https://clamsentinel.sourceforge.net/
4. I don't think it's possible, see https://forums.clamwin.com/viewtopic.php?t=3570

Sorry for late reply. What I want to know is what does ClamWin do different compared to ClamAV? I thought ClamWin was pretty much running off the ClamAV engine. Also does anyone know if ClamAV uses generic signatures?

ClamWin basically provides a GUI for using ClamAV. It also provides some other functionality I'm not familiar with, like Outlook integration. ClamAV has some generic signatures, for example BC.Heuristic.Trojan.SusPacked.BF-6

Yes - ClamWin provides a graphical user interface (the normal version of Clam AV doesn't), Clam AV does not work for Windows, ClamWin lets the user schedule scans, and the use of Clam Sentinel alongside ClamWin enables you to scan with ClamWin (and the Clam Sentinel heuristic engine) as files are added, modified, or compied on your computer. Clam AV is written primarily for email service providers, so real-time scanning, and false positive detections are not important on Clam Av. ClamWin also has protection for false detections on Windows files and some other MS files. I do not believe the current ClamWin port includes complete 64-bit support, but it does support 32-bits.

Regards,

That explains why ClamAV never worked on my system. It seems like you already have your real-time scanner, just in a separate programs, so why not just forge the 2 and you have 1 suite with everything it needs? Only thing I see wrong then is that the real-time scanning needs a bit of a touch-up, for instance, maybe pop-up messages when infection or suspicious files are found with chose answers instead of tray notifications.

Clam Sentinel and ClamWin are different projects. ClamWin uses the Clam AV scan engine and database. Clam AV is written in C++ for Linux email servers and never has to worry about real-time scanning and false positives and different Windows versions. ClamWin uses much of the Clam AV code but has to port it over to Windows, and it also has to accommodate various versions of Windows from Windows 98 up to Windows 8 on both 32 bit and 64 bit machines. Clam Sentinel is written in Delphi (originally for Win 98 machines) and uses the ClamWin port and signatures but also has its own Delphi heuristic scanning engine for on-access scanning. There are lots of differences there in languages/coding, and there are also differences in philosophies. All this makes it very difficult to incorporate into an all-in-one program.

As for helping ClamWin, you can contact the developers via the contact information on the main ClamWin web page and tell them you want to be a beta tester or offer other help as you can--such as coding or translating to another language. You can do the same thing via the Clam Sentinel main web page. Any help is appreciated.

Regards,

I didn't mean to push your software here, I am just trying to get an idea of things around here. Anyways, I will be glad to help out but I think my assistance is better suited with your malware hunting teams. As I get more spare time on my hands, I might consider beta testing. Any samples I find will be sent to ClamAV database team so that ClamWin, ClamAV, and Immunet gets their share out of it as well. Thanks for your guys answers to my questions and I look forward to working with ClamWin.

Your interest is appreciated, and help is always welcome. Also, any help given to Clam AV will also help ClamWin and Clam Sentinel. In fact, Clam AV has asked for knowledgeable users to submit their signatures for the malware files they submit. I understand Clam is looking at a way to facilitate this process.

Regards,