ClamAV
2 min read
Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. Because ClamAV's main use is on file/mail servers for Windows desktops, it primarily detects Windows viruses and malware with its built-in signatures.
Usage
Updating database
Update the virus definitions with:
shell
freshclam
The database files are saved in:
/var/lib/clamav/daily.cvd
/var/lib/clamav/main.cvd
/var/lib/clamav/bytecode.cvd
Start/Enableclamav-freshclam.service so that the virus definitions are kept recent.
Starting the daemon
Note:
• You will need to run freshclam before starting the service for the first time or you will run into trouble/errors which will prevent ClamAV from starting correctly.
• The daemon is not needed if you only want to perform stand-alone scans.
The service is called clamav-daemon.service.
Scanning for viruses
clamscan can be used to scan certain files, home directories, or an entire system:
shell
clamscan myfile
clamscan --recursive --infected /home/archie
clamscan --recursive --infected --exclude-dir='^/sys|^/dev' /
If you would like clamscan to remove the infected file add to the command the --remove option, or you can use --move=/dir to quarantine them.
You may also want clamscan to scan larger files. In this case, append the options --max-filesize=4000M and --max-scansize=4000M to the command. '4000M' is the largest possible value, and may be lowered as necessary.
Using the -l /path/to/file option will print the clamscan logs to a text file for locating reported infections.