ClamAV Antivirus: What It Scans & Which Mode to Pick
ClamAV is an open-source antivirus engine that scans files, email attachments, and web traffic for malware, and the mode you choose depends on whether you need a one-time on-demand scan or continuous on-access protection. This article explains exactly what ClamAV can and cannot scan, and walks you through each mode so you can pick the right one for your server, desktop, or mail gateway.
What ClamAV Can Scan
ClamAV detects viruses, trojans, worms, and other malware using signature-based detection plus a limited form of heuristic analysis. Its core scanning targets include:
- Files and directories – any file type, including archives (ZIP, RAR, 7z, tar, gzip, bzip2), executables, documents, and scripts.
- Email messages – it parses MIME and can scan attachments in formats like PDF, Office documents, and executables.
- Web traffic – when used with a proxy or mail gateway, it can inspect HTTP responses for malicious content.
- Phishing URLs – the database includes a list of known phishing sites that the scanner can flag.
It does not perform real-time behavior monitoring like many commercial antivirus products. It also cannot decrypt encrypted files (e.g., password-protected archives) or scan inside files that are already compressed with an unknown algorithm. For those, you must provide the password or extract them first.
Background: Where ClamAV Comes From
ClamAV was originally released in 2001 by Tomasz Kojm as a Unix-based antivirus tool. It is now maintained by Cisco and is free software under the GNU General Public License. Because it is open-source and lightweight, it became the de facto antivirus for Linux mail servers and is also available on Windows and macOS. Its signature database is updated several times per day, and you can also run your own custom signatures.
How ClamAV Works
ClamAV uses a multi-engine architecture. The core scanner, clamd, is a daemon that listens for scan requests and can be used by other programs. The command-line tool clamscan runs one-off scans. Both rely on the same signature database, which is stored in main.cvd, daily.cvd, and bytecode.cvd files. When you scan a file, the engine decompresses archives, decodes MIME parts, and checks the content against the database. It also uses a small set of heuristics to detect unknown malware that resembles known threats, but this is not as advanced as in commercial products.
Choosing the Right Mode: On-Demand vs. On-Access
ClamAV offers two primary modes of operation. The choice depends on your use case:
- On-demand scan (clamscan) – you run it manually or via cron to scan a file, directory, or the whole system. It is best for periodic checks, scanning uploads, or scanning files before they are used. It does not stay in memory and does not intercept file access.
- On-access scanning (clamd + clamonacc) – the daemon runs continuously and the
clamonacccomponent monitors file access in real time. This is ideal for servers where you want immediate protection, but it requires more resources and careful configuration.
For a desktop Linux system, on-access scanning is often overkill and can slow down file operations. For a mail server, you would typically use clamd via a milter (like clamav-milter) to scan incoming emails. For a web server, you might use on-demand scanning on file uploads or integrate with a virus scanner API.
Common Problems and Misconceptions
One common misconception is that ClamAV provides real-time protection out of the box. It does not. You must explicitly enable on-access scanning, and even then it only monitors file access, not network traffic or process behavior. Another issue is that ClamAV sometimes gives false positives, especially on certain executable packers. If you get a detection that seems wrong, you can check the signature name and whitelist the file or directory. Also, the signature database can grow large; you should run freshclam regularly to keep it updated. If you forget to update, detection rates drop significantly.
Performance and Resource Usage
ClamAV is generally lightweight, but scanning large files or archives can be CPU-intensive. On-access scanning adds overhead to every file read. To reduce impact, you can configure clamd to use a maximum file size and scan only certain extensions. For example, you might set MaxFileSize 25M and MaxScanSize 100M to avoid scanning huge files. Also, you can exclude network filesystems like NFS from on-access scanning to avoid double scanning.
Cost, Safety, and Alternatives
ClamAV is completely free and open-source. It is safe to use on any system, but because it has no real-time behavioral detection, it is not a full replacement for a commercial antivirus on a Windows desktop. On Linux servers, it is a solid choice for scanning email and uploads. Alternatives include Sophos for Linux (free for personal use), Bitdefender, and F-Prot, but those are commercial. For Windows, you might consider Microsoft Defender, which is built-in and offers real-time protection. ClamAV is best when you need a free, scriptable scanner that integrates with your own tools.
Frequently Asked Questions
Can ClamAV detect all malware?
No. It detects known signatures and some heuristics, but it cannot catch zero-day malware or advanced persistent threats. It is not a substitute for a full endpoint protection suite on desktops.
How do I update ClamAV signatures?
Use the freshclam command. It downloads the latest signature files from the ClamAV update servers. You can run it manually or set up a cron job to run it daily.
Does ClamAV work on Windows?
Yes, ClamAV has a Windows version. You can run clamscan.exe from the command line, and there are third-party GUI frontends, but the official release is command-line only.
What is the difference between clamscan and clamd?
clamscan is a standalone tool that starts a scan and exits. clamd is a daemon that stays running and can be used by other programs via a socket. Using clamd is faster for multiple scans because it loads the database once.
Can I use ClamAV to scan email attachments?
Yes, that is one of its main uses. You can integrate it with mail servers like Postfix or Exim using milters or content filters. It parses MIME and scans attachments.
Is on-access scanning worth the overhead?
It depends on your threat model. On a busy file server, the overhead may be acceptable if you need immediate detection. On a desktop, you might prefer on-demand scans to avoid slowing down everyday tasks.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.