ClamAV for Linux: Install and Scan Files

A targeted malware scan on Linux can help you check selected files before sharing them. ClamAV is an open-source scanner that compares file contents with known malware signatures and reports a match.

I’ll show how to install ClamAV and scan a chosen folder, then explain when ClamD is useful for repeated scans.

TL;DR: Install ClamAV and Scan a Chosen Folder

ClamAV installs through your distribution’s package manager. FreshClam updates its signature database, and ClamAV scans the file or folder you select.

• Install the clamav package for one-time command-line scans.
• Use the distribution’s FreshClam updater instead of downloading database files by hand.
• Run a recursive scan on a specific directory and review any detection before taking action.

What Is ClamAV for Linux?

ClamAV is an open-source engine that matches file content against known malware signatures and reports a hit.

ClamAV can inspect supported archive formats.

ClamAV does not track process behavior like an endpoint monitor. It is one file-scanning control, not a complete endpoint protection suite.

I chose the standalone scanner for a one-off file check because the upstream manual says it does not need a background daemon.

How to Install and Use ClamAV on Linux

Install ClamAV through your distribution’s package repository because it manages the program files and configuration with normal system updates.

Step 1: Install the ClamAV Packages

For Debian and Ubuntu, use the apt commands below. Our apt and apt-get comparison explains that command choice.

# Debian or Ubuntu: install the command-line scanner
sudo apt update
sudo apt install clamav

# Add the daemon only if you need clamdscan or a ClamD service
sudo apt install clamav-daemon

# Fedora
sudo dnf install clamav clamav-update

# Add the daemon package only for ClamD-based scans
sudo dnf install clamd

# Arch Linux
sudo pacman -S clamav

Step 2: Update the Signature Database

FreshClam retrieves official signatures over the network into the package-configured database, which ClamScan can later use locally.

# Use this for a one-time update when the package updater is not running
sudo freshclam

Use the manual command only when the package’s updater service is inactive. For DNS or TLS errors, use the FreshClam troubleshooting FAQ.

A local ClamScan run can use the stored database without a network connection. Use FreshClam or cvdupdate to download signatures rather than direct curl or browser downloads.

Step 3: Scan a File or Directory

Set the path to the directory that contains the files you want to inspect.

clamscan -r -i "$HOME/Downloads"

Replace the Downloads folder with the path that contains the files you want to inspect. A match names the file and signature, followed by a summary for the requested path.

• The recursive option includes nested directories, so check that the path is the folder you mean to scan.
• Infected-only output hides ordinary clean-file lines. Remove that option when you need a line for each inspected file.
• Pass a writable log-file path when you need to keep the report for later review.

clamscan -r -i --log="$HOME/clamav-scan.log" "$HOME/Downloads"

A saved log preserves the scan record. Keep it in a private location if its file paths reveal details about your account.

The ClamAV manual has no quick-scan mode. A full-system scan can take a long time. Size limits may skip large files or archive contents, so inspect those settings when a large archive matters to the task.

Check the summary for file-access errors because unreadable files are not examined.

For a scan that runs during other work, a positive nice value lowers its scheduling priority. That can reduce its impact on other work but does not make the scan finish faster. See our guide to the nice command for how that priority works.

nice -n 10 clamscan -r -i "$HOME/Downloads"

Step 4: Use ClamD for Repeated Scans

ClamDScan sends file paths to a configured ClamD service for scanning. Choose this arrangement for repeated work because the daemon keeps its engine available between requests.

clamdscan "$HOME/Downloads"

With a local socket, ClamD opens the path as its service user, so that account needs read access. Check available RAM before enabling it because the engine remains loaded. This Linux memory guide covers ways to inspect RAM.

ClamDScan cannot change engine settings for a scan. Set those options in the daemon’s configuration file.

If you configure a TCP socket, keep it off untrusted networks. ClamAV does not authenticate commands over TCP, so any host that can reach the socket can submit requests.

ClamAV Update and Scan Issues

When FreshClam reports an update lock, use the package-managed updater because a second process can contend for the same database.

The upstream scanner manual warns that automatic deletion can destroy a legitimate file after a false positive. Review a match before quarantining or removing the file.

Conclusion: Keep ClamAV Scans Targeted

Start with the package and scanning manuals when you need distribution-specific defaults or scan-size details. Those boundaries determine what a report can tell you.

For the command and updater details, use the ClamAV scanning manual and the signature database guide.

FAQ

These answers summarize when a ClamAV scan helps and what its result means.