47 lines
1.9 KiB
Markdown
47 lines
1.9 KiB
Markdown
---
|
|
obj: application
|
|
arch-wiki: https://wiki.archlinux.org/title/ClamAV
|
|
website: https://www.clamav.net
|
|
rev: 2024-01-17
|
|
---
|
|
|
|
# ClamAV
|
|
Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. Because ClamAV's main use is on file/mail servers for [Windows](../windows/Windows.md) desktops, it primarily detects [Windows](../windows/Windows.md) viruses and malware with its built-in signatures.
|
|
|
|
## Usage
|
|
### Updating database
|
|
Update the virus definitions with:
|
|
```shell
|
|
freshclam
|
|
```
|
|
|
|
The database files are saved in:
|
|
```
|
|
/var/lib/clamav/daily.cvd
|
|
/var/lib/clamav/main.cvd
|
|
/var/lib/clamav/bytecode.cvd
|
|
```
|
|
|
|
Start/Enable`clamav-freshclam.service` so that the virus definitions are kept recent.
|
|
|
|
### Starting the daemon
|
|
|
|
> **Note:**
|
|
> - You will need to run `freshclam` before starting the service for the first time or you will run into trouble/errors which will prevent ClamAV from starting correctly.
|
|
> - The daemon is not needed if you only want to perform stand-alone scans.
|
|
|
|
The service is called `clamav-daemon.service`.
|
|
|
|
### Scanning for viruses
|
|
`clamscan` can be used to scan certain files, home directories, or an entire system:
|
|
```shell
|
|
clamscan myfile
|
|
clamscan --recursive --infected /home/archie
|
|
clamscan --recursive --infected --exclude-dir='^/sys|^/dev' /
|
|
```
|
|
|
|
If you would like `clamscan` to remove the infected file add to the command the `--remove` option, or you can use `--move=/dir` to quarantine them.
|
|
|
|
You may also want `clamscan` to scan larger files. In this case, append the options `--max-filesize=4000M` and `--max-scansize=4000M` to the command. '4000M' is the largest possible value, and may be lowered as necessary.
|
|
|
|
Using the `-l /path/to/file` option will print the `clamscan` logs to a text file for locating reported infections.
|