Mailing List Archive

ClamAV for Windows
Hello,

I have placed ClamAV on Windows Servers. I am running the clamd.exe in
powershell and then I am running clamdscan.exe in a second powershell
window.
I have fixed the clamd.conf file I have un #ed the exclusion for
c:\windows and I have taken the MaxDirectoryRecursion to 20.
My powershell command for the clamdscan.exe is

cd "c:\program files\clamav"

.\clamdscan.exe . --fdpass -mlv clamd.log "c:\"

The issues that I am having is that the clamd.exe is not reading the
clamd.conf file because my c:\windows is still being scanned and I had a
couple of places where the max directory was longer than 16.

With me having the "c:\" in the clamdscan.exe powershell line, does it then
bypass the exclusion list?

If so, how can I scan the C Drive with clamdscan in powershell?

I have the latest Clamav for Windows installed.


Thank you.
Marcy
Re: ClamAV for Windows [ In reply to ]
Hi there,

On Wed, 21 Oct 2020, Marcy Rogers via clamav-users wrote:

> ... Windows ...

I don't do much with Windows, but I'll try to help. I'm not sure what
exactly the problem is, but I can see some things on your command line
which might need fixing.

> .\clamdscan.exe . --fdpass -mlv clamd.log "c:\"

Quoting from the clamdscan 'man' page:

" --fdpass
Pass the file descriptor permissions to clamd. This is useful
if clamd is running as a different user as it is faster than
streaming the file to clamd. Only available if connected to
clamd via local(unix) socket.
"

As you're using Windows, you won't be using a local(unix) socket. :/
I suggest you try the command again without the --fdpass argument.

Also, although I'm not sure if it matters on a Windows command line I
would expect that a collection of arguments like

-mlv clamd.log

would be written e.g.

-mvl clamd.log

because otherwise the 'l' might refer to 'v' and not 'clamd.log' (and
clamdscan will also try to scan its own log - maybe that's not such a
good idea). To be sure I know what I've asked I'll sometimes use the
longer forms of arguments, e.g.

--multiscan --verbose --log=clamd.log

Finally, I don't know if you need quotes around c:\ or not, I doubt it
matters but if unsure I'd try it both with and without them.

I'll let others with experience of using ClamAV on Windows comment on
the fundamentals of what you're doing (such as scanning a filesystem
which contains your logs), but if after trying some of these things
you don't have more luck, do please get back to us.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: ClamAV for Windows [ In reply to ]
Hi there,

On Wed, 21 Oct 2020, G.W. Haywood wrote:

> ... I can see some things on your command line ...
>
>> .\clamdscan.exe . --fdpass -mlv clamd.log "c:\"

Oh, I forgot to mention the lone 'dot' between exe and --fdpass, which
I don't think should be there...

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: ClamAV for Windows [ In reply to ]
Thank you Ged,

I will take the fdpass out. I was told by the other people in my group to
use that command but they work on Linux. I am the windows person.

I also had my -mlv wrong, It is -mvl. I have the log at the back end next
to the log.

I will remove the fdpass and take the " off of the C: and remove the . and
see how that works.

Marcy

On Wed, Oct 21, 2020 at 1:00 PM G.W. Haywood via clamav-users <
clamav-users@lists.clamav.net> wrote:

> Hi there,
>
> On Wed, 21 Oct 2020, G.W. Haywood wrote:
>
> > ... I can see some things on your command line ...
> >
> >> .\clamdscan.exe . --fdpass -mlv clamd.log "c:\"
>
> Oh, I forgot to mention the lone 'dot' between exe and --fdpass, which
> I don't think should be there...
>
> --
>
> 73,
> Ged.
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>