How should I test Clam Anti-Virus

Some points to consider:

1. Most infections today are malware from websites. That's why desktops would need protection measures in place...most users don't think about defensive web browsing. Even if they do, it's easy to accidentally trigger something, especially with IE.
2. If the NAS is used solely as a file repository, any desktop scanner should be able to scan mapped drive letters as files are accessed.
3. Even if you protect against browse-by malware, anything that is network based...an infected laptop brought into the network behind the firewall...could theoretically propagate itself into the NAS or clients.
4. Scan the NAS to make sure uneeded ports aren't open for some reason. If you don't need the service, shut it down. Make sure you're using encrypted connections for maintenance.
5. Is your NAS being used for Windows profiles? That's a great place for malware to hide.
6. Email: can you block executable files from being attached, period? We used to do that with a homebrew email filter. I got tired of people getting huge attachments and executables that 99.9% of the time were viruses anyway...so I added a filter to the mail forwarder that just blocked all executables and anything over a couple meg in size.
7. There are antivirus scanners for Linux like F-prot, and of course ClamAV but Clam would have to be a cron job since it's designed for email servers and as such is a "plug in", not on access scanning, just on-demand.
8. Your NAS, especially if not Windows based, will most likely be a virus carrier...not actively infected and trying to spread it.

I'd probably work on scheduling (or having another server schedule) a virus check with an antivirus of choice each night using a mapped drive to the NAS with administrative access; that should allay your client's fears a bit. I don't know what your role is in maintaining them (you're a consultant? on-site support?...) so I don't know if you want to put something in place that the user can maintain or if you're setting things up so you can monitor it remotely; i.e., some antivirus programs can email you a notice. If not, you could set up a small Linux box that is dedicated to doing some maintenance like this (logging) and it could use a cron job to scan for viruses every four hours or so and email you the results.

I believe you have other factors to consider.

• How often are the PCs left switched on when not in use?
• Are the PCs used 24/7, or do they sit idle for 16 hours a day?
• Does your AV software's real time scanning, scan on change only, or all reads/writes? (or not at all?) - How reliable is it?
• Will your AV software reschedule a missed scan because a computer is switched off?
• Who is using the computer? (Single user / Multi user)?
• How much do you trust the people using the computers?
• How much data is stored on each computer (hopefully none, as it should all be on the network)
• Do any users have elevated rights on the systems?

Personally, here I perform daily overnight scans (when a PC is left on). But I think that suits our set up. All our machines are dataless (so there isn't a lot of scanning required on each machine), and PCs are mostly switched off when not in use anyway. The answer is probably subjective IMHO.