> Not sure how CLAMAV is finding out about newer versions.
...
> Or it could be as simple as doing a DNS query for a TXT record that has
> version info in it.
It is indeed a DNS query for a TXT record:
dig -t txt current.cvd.clamav.net
;; ANSWER SECTION:
current.cvd.clamav.net. 900 IN TXT "0.97.1:53:13181:1307868945:1:60:30046:143"
Regards,
-JP