Hello,
yes, tried to follow the instructions from you and Dario on what to include and configure.
Regarding adding a shadow to autostart ClamAV 0.93.1.
The WarpIn package contain the following objects and shadows only:
WPS Object: WPFolder ClamAV <WP_DEKSTOP> OBJECTID=<CLAMAV_FOLDER>;
WPS Object: WPShadow Readme 1st <CLAMAV_FOLDER> OBJECTID=<CLAMAV_README>;SHADOWID=$(1)\ReadMe.txt
WPS Object: WPShadow Documentation <CLAMAV_FOLDER> OBJECTID=<CLAMAV_DOCS>;SHADOWID=$(1)\docs
WPS Object: WPProgram ClamAV 0.93.1 daemon <CLAMAV_FOLDER> EXENAME=$(1)\bin\clamd.exe;OBJECTID=<CLAMAV_CLAMD>;ICONFILE=$(1)\bin\clamd.ico;TITLE=ClamAV 0.93.1 daemon;
so I'll leave it as it is...
"Viruses", of course, I'll adjust it!
I have 10000's of messages (>4Gb), and some do contain viruses, trojan, exploits etc. that ClamAV report.
I've tested the script several times with the different configurations set and it can report that I currently have messages containing problems such as
HTML.Phising.Pay-51 FOUND
Email.Phishing.RB-3365 FOUND
while I used it earlier to delete several messages that contained trojans and a few viruses.
I'll modify the script to your suggestions, but please do add your script (version) here too, it may suit more people better.
Another possible improvement would be to write a log and open it, so that the user can see what has been removed and not. But I leave that for you all to think about for a while.

//Jan-Erik
Version 2:
/* Find and add additional icons for scanning and removal of virus */
CALL RxFuncAdd 'SysLoadFuncs', 'RexxUtil', 'SysLoadFuncs'
CALL SysLoadFuncs
CALL SysCls
cfg.1 = 'clamd'
cfg.2 = 'freshclam'
cfg.0 = 2
doexploits = 0
pauseonfound = 0
autostart = 0
showlog = 1
SAY "Delete Virus/Trojans/Exploits etc.? (Y/n)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN DO
SAY "Move Virus/Trojans/Exploits to a folder for inspection (Y/n)?"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) <> 'N' THEN
doexploits = 2
END
ELSE doexploits = 1
IF doexploits = 1 THEN DO
SAY "Ask to delete found Virus/Trojan/Exploit? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
pauseonfound = 1
SAY "Show log afterward? (Y/n)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN
showlog = 0
END
ELSE IF doexploits = 2 THEN DO
SAY "Ask to move found Virus/Trojan/Exploit? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
pauseonfound = 1
SAY "Show log afterward? (Y/n)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN
showlog = 0
END
SAY "Start ClamAV Daemon Automatically at system start? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
autostart = 1
SAY SysGetMessage( 1004,, d2c(8)||'.' )
CALL SysFileTree VALUE( 'PROGRAMS',, 'ENVIRONMENT' )||'\*CLAMDSCAN.EXE', 'file.', 'SFO'
IF file.0 = 0 THEN DO
drives = SysDriveMap()
DO i = 1 to WORDS( drives )
SAY SysGetMessage( 1658,, LEFT( SUBWORD( drives, i, 1 ), 1 ) )
CALL SysFileTree SUBWORD( drives, i, 1 )||'\*CLAMDSCAN.EXE', 'file.', 'SFO'
IF file.0 > 0 THEN LEAVE i
END
END
IF file.0 > 0 THEN DO
fpath = STRIP( FILESPEC( 'D', file.1 )||FILESPEC( 'P', file.1 ), 'T', '\' )
sze_etc = FILESPEC( 'D', file.1 )||FILESPEC( 'P', STRIP( FILESPEC( 'P', file.1 ), 'T', '\' ) )||'ETC'
tgt_etc = VALUE( 'ETC',, 'ENVIRONMENT' )
DO i = 1 TO cfg.0
IF STREAM( tgt_etc||'\'||cfg.i||'.conf', 'C', 'QUERY EXISTS' ) = '' THEN DO /* Don't overwrite existing config */
fsize = STREAM( sze_etc||'\'||cfg.i||'.conf', 'C', 'QUERY SIZE' ) /* Get size of template file */
IF fsize > 0 THEN DO /* If it has has size, then it must exist?! */
finput = CHARIN( sze_etc||'\'||cfg.i||'.conf', 1, fsize ) /* Read the whole file into memory */
CALL STREAM sze_etc||'\'||cfg.i||'.conf', 'C', 'CLOSE' /* Ensure that it's closed properly */
fpos = POS( 'EXAMPLE', TRANSLATE( finput ), 100 ) /* Look for the text EXAMPLE if it exist (not the first one though), uppercase so that we cen ensure we get a match */
IF fpos > 0 THEN DO /* If we find it, fpos will contain the position larger than 0 */
INTERPRET 'PARSE VALUE finput WITH pre '||fpos||' +8 post' /* Split the text in 2 */
finput = pre||post /* Join the text again without Example */
END
CALL LINEOUT tgt_etc||'\'||cfg.i||'.conf', finput /* Write the text to the target file */
CALL STREAM tgt_etc||'\'||cfg.i||'.conf', 'C', 'CLOSE' /* Ensure that it's closed properly */
END
END
END
CALL SysSetObjectData "<CLAMAV_FOLDER>", "OPEN=DEFAULT;"
IF SysCreateObject( "WPProgram", "Update Anti Virus Information", "<CLAMAV_FOLDER>", "EXENAME="||fpath||"\FRESHCLAM.EXE;OBJECTID=<FRESHCLAM>", "U" ) THEN DO
SAY SysGetMessage( 1662,, "Update Anti Virus Information" )
IF DIRECTORY( fpath ) <> '' THEN DO
SAY ""
SAY "Fetching New Anti Virus Information... Please wait"
'@freshclam'
END
END
ELSE
SAY SysGetMessage( 3211,, 'ClamAV Information' )
dclam = fpath||'\CLAMDEL.CMD'
IF STREAM( dclam, 'C', 'QUERY EXIST' ) <> '' THEN
retval = SysFileDelete( dclam )
IF doexploits = 0 THEN DO
SAY ""
SAY "Will just report infections..."
dclam = "EXENAME="||fpath||'\clamdscan.exe;PARAMETERS= --log="'||fpath||'\dClam.log"' /* changed name to dClam.log */
END
ELSE DO
CALL LINEOUT dclam, "/* Script to scan and remove infected files */"
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "CALL RxFuncAdd 'SysLoadFuncs', 'RexxUtil', 'SysLoadFuncs'"
CALL LINEOUT dclam, "CALL SysLoadFuncs"
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "SAY SysGetMessage( 1658,, LEFT( FILESPEC( 'D', ARG(1) ), 1 ) )"
CALL LINEOUT dclam, 'CALL SysFileDelete( "'||fpath||'\dClam.log" )' /* changed name to dClam.log */
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "'"||'@CLAMDSCAN --log="'||fpath||'\dClam.log" "'||"'||ARG(1)||'"||'"'||"'" /* changed name to dClam.log */
CALL LINEOUT dclam, "IF rc <> 0 THEN"
CALL LINEOUT dclam, 'DO WHILE LINES( "'||fpath||'\dClam.log" )' /* changed name to dClam.log */
CALL LINEOUT dclam, ' PARSE VALUE LINEIN( "'||fpath||'\dClam.log" ) WITH fname": "exploit" FOUND"' /* changed name to dClam.log */
CALL LINEOUT dclam, " fname = TRANSLATE( fname, '\', '/' )"
CALL LINEOUT dclam, " IF LENGTH( fname ) > 0 THEN"
CALL LINEOUT dclam, " IF STREAM( fname, 'C', 'QUERY EXISTS' ) <> '' THEN DO"
IF doexploits = 1 THEN DO
CALL LINEOUT dclam, " retval = SysFileDelete( fname )"
CALL LINEOUT dclam, " IF retval = 0 THEN"
CALL LINEOUT dclam, " SAY exploit||' -> '||SysGetMessage( 3378 )"
END
ELSE DO
IF SysCreateObject( "WPFolder", "Infected files", fpath, "OBJECTID=<INFECTION_FOLDER>", "U" ) THEN
retval = SysCreateShadow( '<INFECTION_FOLDER>', '<CLAMAV_FOLDER>' )
ELSE SAY SysGetMessage( 1693 )
CALL LINEOUT dclam, " retval = SysMoveObject( fname, '<INFECTION_FOLDER>' )"
CALL LINEOUT dclam, " IF retval THEN"
CALL LINEOUT dclam, " SAY exploit||' -> '||SysGetMessage( 1907,, 1 )"
END
IF pauseonfound THEN DO
CALL LINEOUT dclam, " ELSE DO"
CALL LINEOUT dclam, " SAY SysGetMessage( 1249,, exploit||' -> '||fname )"
CALL LINEOUT dclam, " SAY SysGetMessage( 1739 )"
CALL LINEOUT dclam, " PARSE PULL answer"
CALL LINEOUT dclam, " IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN"
IF showlog THEN /* Added option to show log if the user don't want to continue */
CALL LINEOUT dclam, " CALL SysSetObjectData '"||fpath||"\dClam.log', 'OPEN=DEFAULT;'" /* open dClam.log */
ELSE
CALL LINEOUT dclam, " RETURN 0 /* otherwise just leave. */
CALL LINEOUT dclam, " END"
END
ELSE DO
CALL LINEOUT dclam, " ELSE"
CALL LINEOUT dclam, " SAY SysGetMessage( 1249,, exploit||' -> '||fname )"
END
CALL LINEOUT dclam, " END"
CALL LINEOUT dclam, "END"
CALL LINEOUT dclam, "CALL STREAM '"||fpath||"\dClam.log', 'C', 'CLOSE'" /* changed name to dClam.log */
IF showlog THEN
CALL LINEOUT dclam, "CALL SysSetObjectData '"||fpath||"\dClam.log', 'OPEN=DEFAULT;'"
CALL STREAM dclam, 'C', 'CLOSE'
dclam = "EXENAME="||dclam||";PARAMETERS="
END
SAY ""
IF SysCreateObject( "WPProgram", "ClamAV Scan", "<CLAMAV_FOLDER>", dclam||" ["||STRIP( STRIP( STRIP( SysGetMessage( 1480,, ' ' ),, D2C(10) ),, D2C(13) ) )||"];OBJECTID=<CLAMDSCAN>;ICONFILE="||fpath||"\clamd.ico;NOAUTOCLOSE=YES", "U" ) THEN /* Added Icon To ClamD Program Object, New default is to leave VIO window open afterward (July 5, 2008) */
SAY SysGetMessage( 1662,, 'ClamAV Scan' )
ELSE SAY SysGetMessage( 3211,, 'ClamAV' )
IF autostart THEN
IF SysCreateShadow( '<CLAMAV_CLAMD>', '<WP_START>' ) THEN DO
SAY 'ClamAV Daemon '||SysGetMessage( 744 )
IF SysSetObjectData( "<CLAMAV_CLAMD>", "OPEN=DEFAULT;" ) THEN
SAY 'ClamAV Daemon '||SysGetMessage( 748 )
ELSE
SAY 'ClamAV Daemon '||SysGetMessage( 749 )
END
ELSE SAY SysGetMessage( 1249,, 'Autostart ClamAV Daemon' )
DO i = 1 TO cfg.0
CALL SysSetObjectData tgt_etc||'\'||cfg.i||'.conf', "OPEN=DEFAULT;"
END
SAY "You can now use ClamAV, but please take your time to check the settings and read the documentation!"
SAY SysGetMessage( 1406 ) /* Corrected/Changed the message to "Press Enter to Continue..." */
PARSE PULL answer
END
ELSE DO
SAY ""
SAY SysGetMessage( 3211,, 'ClamAV' )
SAY SysGetMessage( 1975 )
END