Now that we have ClamWin scanning while a user is logged off, I found out that the virus sigs do not update while logged off either. SOOO…. you have to make in c:\program files\clamwin\bin a file called freshclam.conf and put this in it…
# URL of server where database updates are to be downloaded from
# If this option is given multiple times, each will be tried in
# the order given until an update is successfully downloaded
# Server used to compair sigs for whic is newer
# where to put the new sigs
DatabaseDirectory C:\Documents and Settings\All Users\.clamwin\db
UpdateLogFile c:\program files\clamwin\freshclam.log
#how many times to try before moving on to the next DatabaseMirror
Then you get daily.cvd and main.cvd from clamwin and put them in the ROOT of your webserver.
now we run freshclam.exe . This will get the updates from your webserver and put them on the machine. You could run this via the windows scheduler, or as we did, via a login script.