Where Does ClamAV Get Its Virus Signatures?

ClamAV belongs to Cisco and its Talos Group. Cisco acquired Sourcefire, the makers of Snort and ClamAV in late 2013.

http://www.cisco.com/web/about/ac49/ac0/ac1/ac259/sourcefire.html

http://www.talosintel.com/about/
http://www.cisco.com/c/en/us/products/security/talos.html

© 2004 - 2015 Cisco and/or its affiliates. All rights reserved.

Sourcefire also belongs to Cisco: http://blog.clamav.net/2013/10/cisco-community-and-open-source.html

The signatures are on the server of ClamAV

http://www.clamwin.com/content/view/58/27/

Where can I manually download virus definition files from?

You can get the virus definitions without clamwin via http:// 

http://database.clamav.net/main.cvd
http://database.clamav.net/daily.cvd

Then copy the downloaded main.cvd and daily.cvd to your database location which is specified in the ClamWin Preferences, File Locations tab.

The default database location is: "C:Documents and SettingsAll Users.clamwindb"

Many big contributors are antivirus vendors and security companies: http://www.clamav.net/about#credits

Contributors

ClamAV Team

Joel Esler
Douglas Goddard
Nigel Houghton
Tom Judge
Kevin Lin
Steve Morgan
Matt Olney
Dave Raynor
Samir Sapra
Ryan Steinmetz
Dave Suffling
Matt Watchinkski
Alain Zidouemba

ClamAV QA

Erin Germ
Dragos Malene
Vijay Mistry
Matt Donnan

Talos Group

Andrea Allievi
Jonathan Arneson
Ben Baker
Nathan Benson
Andrew Blunk
Kevin Brooks
Jaime Filson
Paul Frank
Erick Galinkin
Douglas Goddard
Richard Harman, Jr.
Nicholas Herbert
Shaun Hurley
Richard Johnson
Alex Kambis
Brittany Lawler
Justin Lindsey
Chris Marczewski
Christopher Marshall
Nick Mavis
Christopher McBee
David McDaniel
Alex McDonnell
Kevin Miklavcic
Patrick Mullen
Marcin Noga
Katie Nolan
Carlos Pacho
Ryan Pentney
Nick Randolph
Marcos Rodriguez
Geoff Serrao
Brandon Stultz
Nick Suan
Emmanuel Tacheau
Melissa Taylor
Angel Villegas
Andy Walker
Alicia Willett
Yves Younan

Contributors

Aeriana, Andreas Cadhalpun, Mike Cathey, Michael Cichosz, Diego d'Ambra, Arnaud Jacques, Tomasz Papszun, Bill Parker, Robert Scroggins, Sven Strickroth, Trog, Steve Basford, Dennis de Messemacker, Jason Englander, Thomas Lamy, Thomas Masden, Boguslaw Brandys, Anthony Havé, Andreas Faust, Sebastian Andrzej Siewior

ClamAV Emeritus

Luca Gibelli, Török Edvin, Tomasz Kojm, Alberto Wu, Nigel Horne

Each update contains information about the sender, some mention Virus Total, VRT Sandbox and others.

Generally antivirus vendors, security researchers and contributors collaborate and share samples.

http://lists.clamav.net/pipermail/clamav-virusdb/
http://lists.clamav.net/pipermail/clamav-virusdb/2015-December/002519.html

Anyone can contribute and there is also a mailing list for community contributed signatures.

http://blog.clamav.net/2014/02/introducing-clamav-community-signatures.html
http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs