Hi ClamWin team,

1. I noticed that ClamWin engine took about 3000 ms to scan large DLL files. For example, 20-MB DLL attachment is a .net file, not infected.

I know that ClamWin supports the caching feature. However, the first scan still takes that long.
Could you tell me relevant ways to speed up the scanning?

2. I'd like to ask you about the "quickscan" mentioned in https://www.clamav.net/documents/how-to-speed-up-clamwin.

I didn't find in clamdoc.pdf.
Please tell me how I can execute quickscan with specific file types in clamdscan.

Edited: I forgot attaching sample file.
https://www.dropbox.com/s/c7shqtrltq97zrx/mscorlib.ni.zip?dl=0

Thank you,
Dung H. Nguyen

The quick scan article was written to help users speed up scans by ClamWin. ClamWin uses the Clam AV scan engine/virus signatures. Clam AV is written for Linux email servers, for which speed is not important. Clam/ClamWin does not use a cache of virus signatures, so the signatures have to be loaded at the beginning of each scan. The quick scan article said that you can speed up ClamWin scans by limiting the number of extensions, folders, and file sizes that ClamWin scans.

Here's my take on how to speed up ClamWin scans: Most malware is found in files that are under 1 megabyte in size. Most malware (maybe 80%) is found in these extensions: .exe, .dll, .JS, .doc, .docx, .cmd, .htm, .html, .js, .lnk, .pdf, .rtf, .vbs, and .zip. Most malware is initially found in these folders: Windows/system32, Windows/sysWOW64, Windows\temp, and users\appdata. You can limit the amount of time ClamWin scans by using this information in your scheduloed scans and using the limits you want. I think using one or more of these limits is a very good idea if you take the ClamWin developers' advice to only use ClamWin as a backup scanner to a more powerful real-time scanner.

Regards,

Hi GuitarBob,

Thank you for your information.

I'm scanning files with clamdscan.exe, and I can't limit file type or file size due to our demands
Furthermore, the number of files is really large, so I want to speed up the progress.

I'm really appreciate if any advice and suggestions.

Regards,
Dung H. Nguyen

I can't offer anything else in the way of suggestions, and the suggestions offered above do not relate to DLL files specifically. Note that DLL files must be called by an executable file before they are active. If you can find the malicious file and remove it, the DLL file is harmless.

Regards,