Now that we have ClamWin scanning while a user is logged off, I found out that the virus sigs do not update while logged off either. SOOO…. you have to make in c:\program files\clamwin\bin  a file called freshclam.conf and put this in it…

# URL of server where database updates are to be downloaded from
# If this option is given multiple times, each will be tried in
# the order given until an update is successfully downloaded
DatabaseMirror your.webserver.ip
DatabaseMirror database.clamav.net

# Server used to compair sigs for whic is newer
DNSDatabaseInfo current.cvd.clamav.net

# where to put the new sigs
DatabaseDirectory C:\Documents and Settings\All Users\.clamwin\db

UpdateLogFile c:\program files\clamwin\freshclam.log
LogFileMaxSize 1M
LogTime yes

#how many times to try before moving on to the next DatabaseMirror
MaxAttempts 5

Then you get daily.cvd and main.cvd from clamwin and put them in the ROOT of your webserver.

now we run freshclam.exe . This will get the updates from your webserver and put them on the machine. You could run this via the windows scheduler, or as we did, via a login script.