--- a/manifests/moco-nodes.pp
+++ b/manifests/moco-nodes.pp
@@ -38,32 +38,38 @@ node /t-w732-ix-\d+.wintest.releng.scl3.
 ## builders
 
 # Windows
 node /b-2008.*\.(winbuild|build)\.releng\.(scl3|use1|usw2)\.mozilla.com/{
     $node_security_level = 'low'
     $slave_trustlevel = 'core'
     include toplevel::slave::releng::build
 }
-    
+
 # linux64
 node /b-linux64-\w+-\d+.build.releng.scl3.mozilla.com/ {
     # any b-linux64-(something)-digit host in the scl3 build zone
     $node_security_level = 'low'
     $slave_trustlevel = 'core'
     include toplevel::slave::releng::build::mock
 }
 
 node /bld-.*\.build\.releng\.(use1|usw2)\.mozilla.com/ {
     # any bld-(something) host in the use1 and usw2 releng build zones
     $node_security_level = 'low'
     $slave_trustlevel = 'core'
     include toplevel::slave::releng::build::mock
 }
 
+node /av-linux64.*\.build\.releng\.(use1|usw2)\.mozilla\.com/ {
+    $node_security_level = 'low'
+    $slave_trustlevel = 'core'
+    include toplevel::slave::releng::build::mock::av
+}
+
 # OS X
 node /bld-lion-r5-\d+\.build\.releng\.scl3\.mozilla\.com/ {
     # any bld-lion-r5-(digit) hosts in the scl3 build zone
     $slave_trustlevel = 'core'
     $node_security_level = 'low'
     include toplevel::slave::releng::build::standard
 }
 

--- a/modules/aws_manager/manifests/cron.pp
+++ b/modules/aws_manager/manifests/cron.pp
@@ -30,17 +30,17 @@ class aws_manager::cron {
             params          => "-k ${aws_manager::settings::secrets_dir}/aws-secrets.json -c ${repo_root}/configs/watch_pending.cfg -r us-west-2 -r us-east-1 -l ${aws_manager::settings::root}/aws_watch_pending.log";
         "aws_stop_idle.py":
             ensure          => $cron_switch,
             minute          => '*/10',
             process_timeout => 1200,
             cwd             => "${aws_manager::settings::cloud_tools_dst}/scripts",
             virtualenv_dir  => "${aws_manager::settings::root}",
             user            => "${users::buildduty::username}",
-            params          => "-k ${aws_manager::settings::secrets_dir}/aws-secrets.json -u ${users::builder::username} --ssh-key ${users::buildduty::home}/.ssh/aws-ssh-key -r us-west-2 -r us-east-1 -j32 -l ${aws_manager::settings::root}/aws_stop_idle.log -t bld-linux64 -t tst-linux64 -t tst-linux32 -t tst-emulator64 -t try-linux64";
+            params          => "-k ${aws_manager::settings::secrets_dir}/aws-secrets.json -u ${users::builder::username} --ssh-key ${users::buildduty::home}/.ssh/aws-ssh-key -r us-west-2 -r us-east-1 -j32 -l ${aws_manager::settings::root}/aws_stop_idle.log -t bld-linux64 -t tst-linux64 -t tst-linux32 -t tst-emulator64 -t try-linux64 -t av-linux64";
         "aws_sanity_checker.py":
             ensure         => $cron_switch,
             hour           => '6',
             minute         => '0',
             cwd            => "${aws_manager::settings::cloud_tools_dst}/scripts",
             virtualenv_dir => "${aws_manager::settings::root}",
             user           => "${users::buildduty::username}",
             params         => "-r us-west-2 -r us-east-1 -r us-west-1 --events-dir ${aws_manager::settings::events_dir}";
@@ -60,17 +60,17 @@ class aws_manager::cron {
             params         => "-r us-west-2 -r us-east-1 -q";
         "aws_publish_amis.py":
             ensure         => $cron_switch,
             minute         => '*/30',
             cwd            => "${aws_manager::settings::cloud_tools_dst}/scripts",
             virtualenv_dir => "${aws_manager::settings::root}",
             user           => "${users::buildduty::username}";
         "delete_old_spot_amis.py":
-            params         => "-c tst-linux64 -c tst-linux32 -c try-linux64 -c bld-linux64 -c tst-emulator64 -c y-2008 -c b-2008",
+            params         => "-c tst-linux64 -c tst-linux32 -c try-linux64 -c bld-linux64 -c tst-emulator64 -c y-2008 -c b-2008 -c av-linux64",
             ensure         => $cron_switch,
             minute         => '30',
             hour           => '1',
             cwd            => "${aws_manager::settings::cloud_tools_dst}/scripts",
             virtualenv_dir => "${aws_manager::settings::root}",
             user           => "${users::buildduty::username}";
         "try-linux64-ec2-golden":
             script         => "aws_create_instance.py",
@@ -85,16 +85,25 @@ class aws_manager::cron {
             script         => "aws_create_instance.py",
             ensure         => $cron_switch,
             minute         => '15',
             hour           => '1',
             cwd            => "${aws_manager::settings::cloud_tools_dst}/scripts",
             virtualenv_dir => "${aws_manager::settings::root}",
             user           => "${users::buildduty::username}",
             params         => "-c ${repo_root}/configs/bld-linux64 -r us-east-1 -s aws-releng -k ${aws_manager::settings::secrets_dir}/aws-secrets.json --ssh-key ${users::buildduty::home}/.ssh/aws-ssh-key -i ${repo_root}/instance_data/us-east-1.instance_data_prod.json --create-ami --ignore-subnet-check --copy-to-region us-west-2 bld-linux64-ec2-golden";
+        "av-linux64-ec2-golden":
+            script         => "aws_create_instance.py",
+            ensure         => $cron_switch,
+            minute         => '15',
+            hour           => '1',
+            cwd            => "${aws_manager::settings::cloud_tools_dst}/scripts",
+            virtualenv_dir => "${aws_manager::settings::root}",
+            user           => "${users::buildduty::username}",
+            params         => "-c ${repo_root}/configs/av-linux64 -r us-east-1 -s aws-releng -k ${aws_manager::settings::secrets_dir}/aws-secrets.json --ssh-key ${users::buildduty::home}/.ssh/aws-ssh-key -i ${repo_root}/instance_data/us-east-1.instance_data_prod.json --create-ami --ignore-subnet-check --copy-to-region us-west-2 av-linux64-ec2-golden";
         "tst-linux64-ec2-golden":
             script         => "aws_create_instance.py",
             ensure         => $cron_switch,
             minute         => '20',
             hour           => '1',
             cwd            => "${aws_manager::settings::cloud_tools_dst}/scripts",
             virtualenv_dir => "${aws_manager::settings::root}",
             user           => "${users::buildduty::username}",

new file mode 100644
--- /dev/null
+++ b/modules/clamav/files/freshclam.conf
@@ -0,0 +1,216 @@
+##
+## Example config file for freshclam
+## Please read the freshclam.conf(5) manual before editing this file.
+##
+
+
+# Comment or remove the line below.
+#Example
+
+# Path to the database directory.
+# WARNING: It must match clamd.conf's directive!
+# Default: hardcoded (depends on installation options)
+DatabaseDirectory /var/lib/clamav
+
+# Path to the log file (make sure it has proper permissions)
+# Default: disabled
+UpdateLogFile /var/log/clamav/freshclam.log
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes).
+# in bytes just don't use modifiers.
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+# Default: no
+#LogTime yes
+
+# Enable verbose logging.
+# Default: no
+#LogVerbose yes
+
+# Use system logger (can work together with UpdateLogFile).
+# Default: no
+LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# This option allows you to save the process identifier of the daemon
+# Default: disabled
+PidFile /var/run/clamav/freshclam.pid
+
+# By default when started freshclam drops privileges and switches to the
+# "clamav" user. This directive allows you to change the database owner.
+# Default: clamav (may depend on installation options)
+DatabaseOwner clam
+
+# Initialize supplementary group access (freshclam must be started by root).
+# Default: no
+#AllowSupplementaryGroups yes
+
+# Use DNS to verify virus database version. Freshclam uses DNS TXT records
+# to verify database and software versions. With this directive you can change
+# the database verification domain.
+# WARNING: Do not touch it unless you're configuring freshclam to use your
+# own database verification domain.
+# Default: current.cvd.clamav.net
+#DNSDatabaseInfo current.cvd.clamav.net
+
+# Uncomment the following line and replace XY with your country
+# code. See http://www.iana.org/cctld/cctld-whois.htm for the full list.
+# You can use db.XY.ipv6.clamav.net for IPv6 connections.
+#DatabaseMirror db.XY.clamav.net
+
+# database.clamav.net is a round-robin record which points to our most 
+# reliable mirrors. It's used as a fall back in case db.XY.clamav.net is 
+# not working. DO NOT TOUCH the following line unless you know what you
+# are doing.
+DatabaseMirror db.local.clamav.net
+DatabaseMirror db.local.clamav.net
+
+# How many attempts to make before giving up.
+# Default: 3 (per mirror)
+#MaxAttempts 5
+
+# With this option you can control scripted updates. It's highly recommended
+# to keep it enabled.
+# Default: yes
+#ScriptedUpdates yes
+
+# By default freshclam will keep the local databases (.cld) uncompressed to
+# make their handling faster. With this option you can enable the compression;
+# the change will take effect with the next database update.
+# Default: no
+#CompressLocalDatabase no
+
+# With this option you can provide custom sources (http:// or file://) for
+# database files. This option can be used multiple times.
+# Default: no custom URLs
+#DatabaseCustomURL http://myserver.com/mysigs.ndb
+#DatabaseCustomURL file:///mnt/nfs/local.hdb
+
+# Number of database checks per day.
+# Default: 12 (every two hours)
+Checks 24
+
+# Proxy settings
+# Default: disabled
+#HTTPProxyServer myproxy.com
+#HTTPProxyPort 1234
+#HTTPProxyUsername myusername
+#HTTPProxyPassword mypass
+
+# If your servers are behind a firewall/proxy which applies User-Agent
+# filtering you can use this option to force the use of a different
+# User-Agent header.
+# Default: clamav/version_number
+#HTTPUserAgent SomeUserAgentIdString
+
+# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for
+# multi-homed systems.
+# Default: Use OS'es default outgoing IP address.
+#LocalIPAddress aaa.bbb.ccc.ddd
+
+# Send the RELOAD command to clamd.
+# Default: no
+NotifyClamd /etc/clamd.conf
+
+# Run command after successful database update.
+# Default: disabled
+#OnUpdateExecute command
+
+# Run command when database update process fails.
+# Default: disabled
+#OnErrorExecute command
+
+# Run command when freshclam reports outdated version.
+# In the command string %v will be replaced by the new version number.
+# Default: disabled
+#OnOutdatedExecute command
+
+# Don't fork into background.
+# Default: no
+#Foreground yes
+
+# Enable debug messages in libclamav.
+# Default: no
+#Debug yes
+
+# Timeout in seconds when connecting to database server.
+# Default: 30
+#ConnectTimeout 60
+
+# Timeout in seconds when reading from database server.
+# Default: 30
+#ReceiveTimeout 60
+
+# With this option enabled, freshclam will attempt to load new
+# databases into memory to make sure they are properly handled
+# by libclamav before replacing the old ones.
+# Default: yes
+#TestDatabases yes
+
+# When enabled freshclam will submit statistics to the ClamAV Project about
+# the latest virus detections in your environment. The ClamAV maintainers
+# will then use this data to determine what types of malware are the most
+# detected in the field and in what geographic area they are.
+# Freshclam will connect to clamd in order to get recent statistics.
+# Default: no
+#SubmitDetectionStats /path/to/clamd.conf
+
+# Country of origin of malware/detection statistics (for statistical
+# purposes only). The statistics collector at ClamAV.net will look up
+# your IP address to determine the geographical origin of the malware
+# reported by your installation. If this installation is mainly used to
+# scan data which comes from a different location, please enable this
+# option and enter a two-letter code (see http://www.iana.org/domains/root/db/)
+# of the country of origin.
+# Default: disabled
+#DetectionStatsCountry country-code
+
+# This option enables support for our "Personal Statistics" service. 
+# When this option is enabled, the information on malware detected by
+# your clamd installation is made available to you through our website.
+# To get your HostID, log on http://www.stats.clamav.net and add a new
+# host to your host list. Once you have the HostID, uncomment this option
+# and paste the HostID here. As soon as your freshclam starts submitting
+# information to our stats collecting service, you will be able to view
+# the statistics of this clamd installation by logging into
+# http://www.stats.clamav.net with the same credentials you used to
+# generate the HostID. For more information refer to:
+# http://www.clamav.net/support/faq/faq-cctts/
+# This feature requires SubmitDetectionStats to be enabled.
+# Default: disabled
+#DetectionStatsHostID unique-id
+
+# This option enables support for Google Safe Browsing. When activated for
+# the first time, freshclam will download a new database file (safebrowsing.cvd)
+# which will be automatically loaded by clamd and clamscan during the next
+# reload, provided that the heuristic phishing detection is turned on. This
+# database includes information about websites that may be phishing sites or
+# possible sources of malware. When using this option, it's mandatory to run
+# freshclam at least every 30 minutes.
+# Freshclam uses the ClamAV's mirror infrastructure to distribute the
+# database and its updates but all the contents are provided under Google's
+# terms of use. See http://code.google.com/support/bin/answer.py?answer=70015
+# and http://safebrowsing.clamav.net for more information.
+# Default: disabled
+#SafeBrowsing yes
+
+# This option enables downloading of bytecode.cvd, which includes additional
+# detection mechanisms and improvements to the ClamAV engine.
+# Default: enabled
+#Bytecode yes
+
+# Download an additional 3rd party signature database distributed through
+# the ClamAV mirrors. Here you can find a list of available databases:
+# http://www.clamav.net/download/cvd/3rdparty
+# This option can be used multiple times.
+#ExtraDatabase dbname1
+#ExtraDatabase dbname2

new file mode 100644
--- /dev/null
+++ b/modules/clamav/files/freshclam.init
@@ -0,0 +1,56 @@
+#!/bin/sh
+#
+# Startup script for freshclam
+#
+# chkconfig: - 61 39
+# description: Clam AntiVirus Database refresher
+# processname: freshclam
+# pidfile: /var/run/clamav/freshclam.pid
+# config: /etc/freshclam.conf
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+# Source networking configuration.
+. /etc/sysconfig/network
+
+[ -x /usr/bin/freshclam ] || exit 0
+
+# See how we were called.
+case "$1" in
+  start)
+	echo -n "Starting Freshclam Daemon: "
+	daemon freshclam -d
+	RETVAL=$?
+	echo
+	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/freshclam
+	;;
+  stop)
+	echo -n "Stopping Freshclam Daemon: "
+	killproc freshclam
+	rm -f /var/run/freshclam.pid
+	RETVAL=$?
+	echo
+### heres the fix... we gotta remove the stale files on restart
+	[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/freshclam
+	;;
+  status)
+	status freshclam
+	RETVAL=$?
+	;;
+  restart|reload)
+	$0 stop
+	$0 start
+	RETVAL=$?
+	;;
+  condrestart)
+	[ -e /var/lock/subsys/freshclam ] && restart
+	RETVAL=$?
+	;;
+  *)
+	echo "Usage: freshclam {start|stop|status|restart|reload|condrestart}"
+	exit 1
+esac
+
+exit $RETVAL
+

new file mode 100644
--- /dev/null
+++ b/modules/clamav/manifests/daemon.pp
@@ -0,0 +1,13 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+class clamav::daemon {
+    include packages::clamd
+
+    service {
+        "clamd":
+            require => Class["packages::clamd"],
+            enable => true;
+    }
+}

new file mode 100644
--- /dev/null
+++ b/modules/clamav/manifests/freshclam.pp
@@ -0,0 +1,27 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+class clamav::freshclam {
+    include packages::clamd
+
+    file {
+        "/etc/freshclam.conf":
+            source => "puppet:///modules/$module_name/freshclam.conf";
+        "/etc/init.d/freshclam":
+            mode   => 0755,
+            source => "puppet:///modules/$module_name/freshclam.init";
+    }
+    exec {
+        # Run freshclam after clamd is installed to refresh the initial database
+        "/usr/bin/freshclam":
+            refreshonly => true,
+            require     => File["/etc/freshclam.conf"],
+            subscribe   => Class["packages::clamd"];
+    }
+    service {
+        "freshclam":
+            require => File["/etc/init.d/freshclam"],
+            enable  => true;
+    }
+}

new file mode 100644
--- /dev/null
+++ b/modules/packages/manifests/clamd.pp
@@ -0,0 +1,18 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+class packages::clamd {
+    case $::operatingsystem {
+        CentOS: {
+            package {
+                "clamd":
+                    ensure => latest;
+            }
+        }
+        default: {
+            fail("cannot install on $::operatingsystem")
+        }
+    }
+}
+

new file mode 100644
--- /dev/null
+++ b/modules/toplevel/manifests/slave/releng/build/mock/av.pp
@@ -0,0 +1,8 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+class toplevel::slave::releng::build::av inherits toplevel::slave::releng::build::mock {
+    include clamav::daemon
+    include clamav::freshclam
+}