Installing ClamAV on Windows

If you wish to build ClamAV from source using Visual Studio 2015, please head over to the Win32 ClamAV Build Instructions located in our source release materials on ClamAV.net and on GitHub.

Install using the ClamAV Windows Installer

Important: Installing ClamAV using the Installer will require Administrator privileges.

Download: http://www.clamav.net/downloads/production/ClamAV-0.103.1.exe

Locate the file in your Downloads directory.

Right-click on ClamAV-0.103.1.exe and select Run as administrator. You may receive a warning message along the lines of “Windows protected your PC”. Select More info and then select Run anyway.

Select I accept the agreement and click Next.

Click Next again. If you’ve removed a previous installation of ClamAV, you may receive the prompt “The folder … already exists…”. If you do, select Yes.

Click Install.

Click Finish.

Press the Windows-key and type powershell but DO NOT press Enter. Right-click on Windows PowerShell at the top of the menu and select Run as administrator. Your computer may warn you Do you want to allow this app to make changes to your device? Click Yes.

Verify that the prompt in the PowerShell window looks like this:

      PS C:\WINDOWS\system32>
  

In the Adminstrator PowerShell window, enter the following to navigate to the ClamAV install directory:

      cd "c:\program files\clamav"
  

Continue on to “First Time Set-Up” below…

Install using the ClamAV Portable Install Package

Download: https://www.clamav.net/downloads/production/clamav-0.103.1-win-x64-portable.zip

Unzip it.

Open the clamav-0.103.1-win-x64-portable directory.

Hold down Shift and then right-click on the background in the current directory (but not on one of the files). Select "Open PowerShell window here". If that option doesn’t appear, try again.

Continue on to “First Time Set-Up”…

First Time Set-Up

In the PowerShell window, perform the following tasks:

• Run:

      copy .\conf_examples\freshclam.conf.sample .\freshclam.conf
      copy .\conf_examples\clamd.conf.sample .\clamd.conf
  

• Run:

      write.exe .\freshclam.conf
  

  WordPad will pop up. Delete the line that says “Example”. You may also wish to set additional options to enable features or alter default behavior, such as the receive-timeout. Save the file and close WordPad.

• Run:

      write.exe .\clamd.conf
  

  WordPad will pop up. Delete the line that says “Example”. You may also wish to set additional options to enable features or alter default behavior, such as enabling logging. Save the file and close WordPad.

Additional notes about the config files and database directories

The install directory is but one of a few locations ClamAV may search for configs and for signature databases.

Config files path search order

The content of the registry key: “HKEY_LOCAL_MACHINE/Software/ClamAV/ConfDir”

The directory where libclamav.dll is located: “C:\Program Files\ClamAV”

“C:\ClamAV”

Database files path search order

The content of the registry key: “HKEY_LOCAL_MACHINE/Software/ClamAV/DataDir”

The directory “database” inside the directory where libclamav.dll is located: “C:\Program Files\ClamAV\database”

“C:\ClamAV\db”

Next Steps

Download the Signature Databases

Before you can start the ClamAV scanning engine (using either clamd or clamscan), you must first have ClamAV Virus Database (.cvd) file(s) installed in the appropriate location on your system. The default location for these database files is C:\Program Files\ClamAV\database, the database directory of your ` (in Windows).

Continuing in the PowerShell window:

Run:

      .\freshclam.exe
  

freshclam will download some files and drop them in the database directory. This can take a minute or two depending on how fast your internet connection is. The files are a pretty large.

You are now ready to perform scans with ClamAV. If you using the portable install package, you may now copy the entire clamav-0.100.1-win-x64-portable directory to the computer(s) you wish to scan.

Steps to Perform Basic Scanning

• Run this to scan the files in the current directory:

      .\clamscan.exe .
  

  This will scan the current directory. At the end of the scan, it will display a summary. If you notice in the clamscan output, it only scanned something like 60 files, even though there are more files in subdirectories. By default, clamscan will only scan files in the current directory.

• Run this to scan all the files in the current directory:

      .\clamscan.exe --recursive .
  

• Run this to scan ALL the files on your C: drive, it will take quite a while. Keep in mind that you can cancel it at any time by pressing Ctrl-C:

      .\clamscan --recursive C:\
  

• For more information on ways you can use clamscan, run:

      .\clamscan.exe --help
  

Faster a-la-carte Scanning with ClamD

You may have noticed that clamscan.exe takes a while to get started. This is because it loads the signature database each time you start a scan. If you require faster scanning of individual files, you will want to use clamd.exe with clamdscan.exe instead. Please note that many of the command line options for clamscan should instead be configured in clamd.conf when using clamd.exe.

Continuing in the PowerShell window:

Run:

      .\clamd.exe
  

The application will take a moment to load and then appear to hang, but it is in fact waiting for scanning commands from clamdscan.exe.

Open a second PowerShell window as you did above, in the same directory.

In the second PowerShell window, you can now run clamdscan.exe much the same way you did with clamscan.exe above.

      .\clamdscan.exe .
  

Additional Notes about Windows-specific Issues

Globbing

Since the Windows command prompt doesn’t take care of wildcard expansion, minimal emulation of unix glob() is performed internally. It supports * and ? only.

File paths

Please always use the backslash as the path separator. SMB Network shares and UNC paths are supported.

Socket and libclamav API Input

The Windows version of ClamAV requires all the input to be UTF-8 encoded.

This affects:

• The API, notably the cl_scanfile() function
• ClamD socket input, e.g. the commands SCAN, CONTSCAN, MUTLISCAN, etc.
• ClamD socket output, i.e replies to the above queries

For legacy reasons ANSI (i.e. CP_ACP) input will still be accepted and processed as before, but with two important remarks:

Socket replies to ANSI queries will still be UTF-8 encoded.

ANSI sequences which are also valid UTF-8 sequences will be handled as UTF-8.

As a side note, console output (stdin and stderr) will always be OEM encoded, even when redirected to a file.