ClamAV Malware Scanning in Practice: Linux Antivirus Engine Deploy and Configuration Guide

ClamAV is the common open-source antivirus engine on Linux servers. Scan web dirs, mail attachments, and uploads. Covers install, signature updates, scheduled scans, alerting, and verification.

ClamAV malware scanning is a primary Linux-server control against viruses, trojans, and ransomware. Fits periodic scans of web upload dirs, mail attachments, and shared storage. This guide covers full Linux deploy: signature updates, clamscan vs clamd, cron, and alerting, with copy-paste commands.

Use Cases

• Periodic malware scans of web upload dirs and FTP shares
• Mail-server attachment scanning (Postfix/Amavisd integration)
• Full-disk hunt after suspected cryptominer or WebShell
• Host antivirus baseline for MLPS 2.0

Prerequisites

• Ubuntu 18.04+ / Debian 10+ / CentOS 7+
• root; clamd resident scan: 1GB+ RAM recommended
• Outbound access for signature downloads (intranet: proxy or offline update)

How It Works

ClamAV is a signature-based open-source AV engine. It matches known malware via CVD databases, plus heuristics and PUA detection. Three core components: clamscan, a one-shot CLI scanner that loads signatures on start (cron-friendly); clamd, a resident daemon with signatures in memory (fast, high-frequency, third-party callers); freshclam, periodic signature updater. Default check interval is every two hours. Detection of newly added samples tracks update frequency.

Procedure

1. Install ClamAV

# Debian / Ubuntu
apt-get update && apt-get install -y clamav clamav-daemon clamav-freshclam
# CentOS 7 / RHEL
# yum install -y epel-release
# yum install -y clamav clamav-update

2. Mirror and update signatures

# Edit /etc/clamav/freshclam.conf; you can specify a China mirror to speed up updates
echo "DatabaseMirror db.cn.clamav.net" | sudo tee -a /etc/clamav/freshclam.conf
sudo freshclam

First update takes a few minutes. Signatures live in /var/lib/clamav/. On failure, check network and 80/443 to the mirror.

3. Manual clamscan

clamscan -r -i /var/www/html
# -r recurse subdirectories; -i output infected files only; --remove can auto-delete (use with caution)

-r -i is the daily patrol combo: infected files only, no log flood.

4. Configure clamd

# Edit /etc/clamav/clamd.conf key parameters
LocalSocket /var/run/clamav/clamd.sock
MaxThreads 4
ScanOnAccess yes
OnAccessMountPath /var/www
OnAccessPrevention yes
LogFile /var/log/clamav/clamav.log

systemctl restart clamav-daemon && systemctl enable clamav-daemon
# Use clamdscan to scan via the resident daemon (first run needs signature warmup)
clamdscan -i /var/www/html

OnAccessPrevention blocks writes that hit the signature set in real time. Use on upload dirs. I/O cost is real; measure in prod first.

5. Scheduled scan and mail alert

cat > /usr/local/bin/clamav_scan.sh <<'EOF'
#!/bin/bash
LOG=/var/log/clamav/scan_$(date +%F).log
INFECTED=$(clamscan -r -i /var/www /home 2>/dev/null | grep -c "FOUND")
echo "infect_count=$INFECTED at $(date)" >> /var/log/clamav/scan_summary.log
if [ "$INFECTED" -gt 0 ]; then
  mail -s "[ALERT] ClamAV found $INFECTED file(s)" admin@example.com < $LOG
fi
EOF
chmod +x /usr/local/bin/clamav_scan.sh
crontab -e
# Run daily at 02:00
0 2 * * * /usr/local/bin/clamav_scan.sh

6. EICAR test file

echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.com
clamscan /tmp/eicar.com
# Expected: Eicar-Signature FOUND; exit code 1

EICAR is the international AV test sample, not a real virus. Safe for pipeline checks.

Verification

• freshclam prints Database updated, no ERROR; signature version > 0
• clamscan /tmp/eicar.com hits Eicar-Signature; echo $? returns 1
• systemctl status clamav-daemon active; clamdscan --ping returns PONG
• Writing EICAR under OnAccessMountPath is blocked in real time (OnAccessPrevention=yes)
• crontab -l shows the job; next day /var/log/clamav/scan_summary.log has a run record

FAQ

FAQ 1: clamscan false-positives on business files?

Confirm file origin and signature type. If true FP, ExcludePath the dir in /etc/clamav/clamd.conf, or whitelist a file hash. Do not exclude the world to save time.

FAQ 2: clamscan is slow every run. How to speed up?

Switch to clamdscan against resident clamd (signatures stay in memory). Scan only critical dirs (/var/www, /tmp, /home), not the whole disk. Raise MaxThreads. Lower ArchiveMaxFileSize and related extract limits to cut archive-scan cost.

FAQ 3: Can ClamAV replace commercial AV for real-time protection?

No. ClamAV is free, open, easy to integrate; signature coverage and detection rate trail commercial engines. Combine: ScanOnAccess on upload dirs, daily cron on disk and web dirs, plus WAF and HIDS (Wazuh, Falco) for layered defense.

Summary

ClamAV adds malware detection to Linux servers at low cost. Landing points: keep signatures current with freshclam, keep clamd resident for scan performance, cron for routine hunts, EICAR to prove the pipeline. Pair with WebShell hunting and file-integrity monitoring (AIDE) to cover most host-level malicious-file cases.