clamav

Scan a file for viruses

$ clamscan [path/to/file]

$ clamscan -r [path/to/directory]

$ clamscan -r --remove [path/to/directory]

$ clamscan -r --move=[path/to/quarantine] [path/to/directory]

$ clamscan -r -i -v [path/to/directory]

$ sudo freshclam

$ clamdscan [path/to/file]

clamscan [options] [file/directory]

ClamAV is an open-source antivirus engine for detecting trojans, viruses, malware, and other malicious threats. The suite includes clamscan for on-demand scanning, clamd as a multi-threaded daemon, clamdscan for daemon-based scanning, and freshclam for automatic signature updates.
ClamAV is widely used in mail gateway scanning, particularly on Unix-based systems. It supports scanning of archives (ZIP, RAR, TAR, GZIP), documents (PDF, Office formats), executables, and many other file types. The signature database is maintained by Cisco Talos and updated multiple times daily.
For high-volume scanning, running the clamd daemon provides significantly better performance than repeated clamscan invocations, as it keeps the signature database loaded in memory.

-r, --recursive

Scan directories and their subdirectories recursively.

Only print infected files in the output.

Remove infected files. Use with caution.

Move infected files to the specified quarantine directory.

Copy infected files to the specified directory.

Be verbose during scanning.

Save scan report to the specified file.

Sound bell on virus detection.

Exclude files matching the regular expression.

Only scan files matching the regular expression.

Skip files larger than the specified size (default 100M).

Display help information.

/etc/clamav/clamd.conf

Main daemon configuration including socket path, scan limits, and logging.

Virus database update settings including mirror, proxy, and update frequency.

ClamAV is primarily designed for server-side scanning of incoming files rather than real-time desktop protection. Scan times can be slow on large directories. The --remove option permanently deletes files without confirmation. Always keep virus definitions updated with freshclam for effective detection.

ClamAV was created by Tomasz Kojm in 2001 as a GPL-licensed antivirus toolkit for Unix. It gained widespread adoption for mail server scanning. Sourcefire acquired the project in 2007, and after Cisco acquired Sourcefire in 2013, the project continues under Cisco Talos security intelligence.

freshclam(1), clamd(8), clamdscan(1), sigtool(1)