ClamAV (Clam AntiVirus) is a

free software Free software, libre software, libreware sometimes known as freedom-respecting software is computer software distributed open-source license, under terms that allow users to run the software for any purpose as well as to study, change, distribut ...

, cross-platform antimalware toolkit able to detect many types of malware, including

viruses A virus is a submicroscopic infectious agent that replicates only inside the living cells of an organism. Viruses infect all life forms, from animals and plants to microorganisms, including bacteria and archaea. Viruses are found in almo ...

. It was developed for

Unix Unix (, ; trademarked as UNIX) is a family of multitasking, multi-user computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, a ...

and has third party versions available for AIX,

BSD The Berkeley Software Distribution (BSD), also known as Berkeley Unix or BSD Unix, is a discontinued Unix operating system developed and distributed by the Computer Systems Research Group (CSRG) at the University of California, Berkeley, beginni ...

HP-UX HP-UX (from "Hewlett Packard Unix") is a proprietary software, proprietary implementation of the Unix operating system developed by Hewlett Packard Enterprise; current versions support HPE Integrity Servers, based on Intel's Itanium architect ...

Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...

macOS macOS, previously OS X and originally Mac OS X, is a Unix, Unix-based operating system developed and marketed by Apple Inc., Apple since 2001. It is the current operating system for Apple's Mac (computer), Mac computers. With ...

OpenVMS OpenVMS, often referred to as just VMS, is a multi-user, multiprocessing and virtual memory-based operating system. It is designed to support time-sharing, batch processing, transaction processing and workstation applications. Customers using Op ...

, OSF (Tru64),

Solaris Solaris is the Latin word for sun. It may refer to: Arts and entertainment Literature, television and film * ''Solaris'' (novel), a 1961 science fiction novel by Stanisław Lem ** ''Solaris'' (1968 film), directed by Boris Nirenburg ** ''Sol ...

and

Haiku is a type of short form poetry that originated in Japan. Traditional Japanese haiku consist of three phrases composed of 17 Mora (linguistics), morae (called ''On (Japanese prosody), on'' in Japanese) in a 5, 7, 5 pattern; that include a ''kire ...

. As of version 0.97.5, ClamAV builds and runs on

Microsoft Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...

. Both ClamAV and its updates are made available free of charge. One of its main uses is on mail servers as a server-side email virus scanner.

History

ClamAV was initially released with version 0.10 on May 8, 2002, by Polish university student Tomasz Kojm.Celebrating 20 years of ClamAV
/ref> In 2007, it was acquired by Sourcefire,Sourcefire acquires ClamAV
/ref> which in turn was acquired by

Cisco Cisco Systems, Inc. (using the trademark Cisco) is an American multinational digital communications technology conglomerate corporation headquartered in San Jose, California. Cisco develops, manufactures, and sells networking hardware, s ...

in 2013Cisco Acquires Cybersecurity Company Sourcefire For $2.7B
/ref> and now operates under its

Talos In Greek mythology, Talos, also spelled Talus (; , ''Tálōs'') or Talon (; , ''Tálōn''), was a man of bronze who protected Crete from pirates and invaders. Despite the popular idea that he was a giant, no ancient source states this explicitl ...

cybersecurity division.

Patent lawsuit

In 2008, Barracuda Networks was sued by

Trend Micro is an American-Japanese cyber security software company. The company has globally dispersed R&D in 16 locations across every continent excluding Antarctica. The company develops enterprise security software for servers, containers, and cloud ...

for its distribution of ClamAV as part of a security package. Trend Micro claimed that Barracuda's utilization of ClamAV infringes on a

software patent A software patent is a patent on a piece of software, such as a computer program, library, user interface, or algorithm. The validity of these patents can be difficult to evaluate, as software is often at once a product of engineering, something ...

for filtering viruses on an Internet gateway. The

free software community The free software movement is a social movement with the goal of obtaining and guaranteeing certain freedoms for software users, namely the freedoms to run, study, modify, and share copies of software. Software which meets these requirements, ...

responded in part by calling for a

boycott A boycott is an act of nonviolent resistance, nonviolent, voluntary abstention from a product, person, organisation, or country as an expression of protest. It is usually for Morality, moral, society, social, politics, political, or Environmenta ...

against Trend Micro. The boycott was also endorsed by the

Free Software Foundation The Free Software Foundation (FSF) is a 501(c)(3) non-profit organization founded by Richard Stallman on October 4, 1985. The organisation supports the free software movement, with the organization's preference for software being distributed ...

. Barracuda Networks counter-sued with IBM-obtained patents in July 2008. On May 19, 2011, the U.S. Patent and Trademark Office issued a Final Rejection in the reexamination of Trend Micro's U.S. patent 5,623,600.

Features

ClamAV includes a command-line scanner, automatic database updater, and a scalable multi-threaded

daemon A demon is a malevolent supernatural being, evil spirit or fiend in religion, occultism, literature, fiction, mythology and folklore. Demon, daemon or dæmon may also refer to: Entertainment Fictional entities * Daemon (G.I. Joe), a character ...

running on an anti-virus engine from a shared library. The application features a

Milter Milter (portmanteau for ''mail filter'') is an extension to the widely used open source mail transfer agents (MTA) Sendmail and Postfix. It allows administrators to add mail filters for filtering spam or viruses in the mail-processing chain. I ...

interface for sent mail and on-demand scanning. It recognizes: * ZIP, RAR, Tar,

Gzip gzip is a file format and a software application used for file compression and decompression. The program was created by Jean-loup Gailly and Mark Adler as a free software replacement for the compress program used in early Unix systems, and ...

Bzip2 bzip2 is a free and open-source file compression program that uses the Burrows–Wheeler algorithm. It only compresses single files and is not a file archiver. It relies on separate external utilities such as tar for tasks such as handli ...

, OLE2, Cabinet, CHM,

BinHex BinHex, originally short for "binary-to-hexadecimal", is a binary-to-text encoding system which was used on the classic Mac OS for sending binary files over email. BinHexed files take up more space than the original files, but avoid data corruption ...

, and SIS formats * Most mail file formats *

ELF An elf (: elves) is a type of humanoid supernatural being in Germanic peoples, Germanic folklore. Elves appear especially in Norse mythology, North Germanic mythology, being mentioned in the Icelandic ''Poetic Edda'' and the ''Prose Edda'' ...

and

Portable Executable The Portable Executable (PE) format is a file format for executables, object file, object code, Dynamic-link library, dynamic-link-libraries (DLLs), and binary files used on 32-bit and 64-bit Microsoft Windows, Windows operating systems, as well ...

(PE) files compressed with UPX, FSG, Petite, NsPack, wwpack32, MEW, and Upack, or obfuscated with SUE, Y0da Cryptor. * Office Open XML file formats,

HTML Hypertext Markup Language (HTML) is the standard markup language for documents designed to be displayed in a web browser. It defines the content and structure of web content. It is often assisted by technologies such as Cascading Style Sheets ( ...

Rich Text Format ) As an example, the following RTF code would be rendered as follows: This is some bold text. Character encoding A standard RTF file can only consist of 7-bit ASCII characters, but can use escape sequences to encode other characters. ...

(RTF) and

Portable Document Format Portable document format (PDF), standardized as ISO 32000, is a file format developed by Adobe in 1992 to present documents, including text formatting and images, in a manner independent of application software, hardware, and operating syste ...

(PDF). The ClamAV virus database is updated at least every four hours and as of 10 February 2017 contained over 5,760,000 virus signatures with the daily update Virus DB number at 23040.

Real-time file scanning

In older

application versions, ClamAV did support real-time protection via the Fanotify add-on for the Linux kernel (version 3.8 and later.) Alternatively, one could use ClamFS (for any

Unix-like A Unix-like (sometimes referred to as UN*X, *nix or *NIX) operating system is one that behaves in a manner similar to a Unix system, although not necessarily conforming to or being certified to any version of the Single UNIX Specification. A Uni ...

operating system An operating system (OS) is system software that manages computer hardware and software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ...

supporting FUSE). Nowadays, the Real-Time Protection in Linux Systems, is provided through ClamAV's ClamOnAcc application (under the name of "''On-Access Scanning''") – which uses ''Clamd'' to provide real-time protection by scanning files when they are accessed. In other words, the ''On-Access Scanner'' can detect and prevent access to malicious files based on the verdict received from ''Clamd''. By default, it operates in "''notify-only mode''", alerting users of any threats detected without actively blocking file access. Enabling "''prevention mode''" can considerably impact performance, especially in commonly accessed directories, so it is advised to use it judiciously. In order to use ClamOnAcc, users need to first run clamd and then start the On-Access Scanner as root (to leverage its kernel event detection and intervention capabilities). Configuration for On-Access Scanning is primarily done through ''clamd.conf,'' with additional options available in the On-Access Scanning User Guide. Users can run multiple instances of ClamOnAcc simultaneously with different configurations, allowing for customized protection settings for various directories. ''ClamOnAcc'' (v0.102+) is a client application that operates alongside clamd (the ClamAV daemon), to perform On-Access Scanning. Regarding previous versions that were meant for

, a free, open-source app called Clam Sentinel did use to detect file changes and scanned modified files using ClamWin. It did work with Windows 98 and later. In addition to on-access scanning, it used to feature optional system change messages and proactive heuristic protection.

Effectiveness

In the 2008

AV-TEST AV-TEST is an independent organization which evaluates and rates antivirus and security suite software for Microsoft Windows, macOS and Android operating systems, according to a variety of criteria. The organisation is based in Magdeburg, Germany ...

comparison of antivirus tools, ClamAV scored poorly in on-demand detection, avoiding false positives, and rootkit detection. In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28%. In 2022 Splunk conducted an efficacy study involving 416,561 malware samples sourced from MalwareBazaar, bucketed as follows: 106135 Banking Trojans (trojans targeted towards stealing financial information); 26875 Botnets (malware for making the victim a part of a botnet); 190371 Information Stealers (programs designed to steal client information. E.g. Keyloggers); 52422 Loaders (program that loads one or more other malicious programs – that is, a stager that fetches harmful things directly into memory); 1321 Miners (crypto currency miners); 30251 RATs (Remote access tools. E.g. Backdoors); and 8273 Trojans (a generic multipurpose malware that harms the user in different ways – generally disguises itself and delivered by tricking the user). Splunk's study concluded ClamAV was 59.94% effective overall at detecting commodity malware – being able to detect 249,696/416,561 samples. In that same study, ClamAV performed relatively well at detecting certain types of malware in certain types of files (E.g. DOCX files, DIL files, ELF files, DOC files and EXE files), but was less effective in detecting malware in JAR files, JS files, VBS files, Z files, RAR files, and XLSB files. In addition, ClamAV performed well in detecting a few top level categories of malware like Trojans & Botnets but performed poorly on other malware types like Crypto Miners, RATs and Info Stealers.

Unofficial databases

The ClamAV engine can be reliably used to detect several kinds of malicious files. In particular, some

phishing Phishing is a form of social engineering and a scam where attackers deceive people into revealing sensitive information or installing malware such as viruses, worms, adware, or ransomware. Phishing attacks have become increasingly sophisticate ...

emails can be detected using antivirus techniques. However, false positive rates are inherently higher than those of traditional malware detection. There are several unofficial databases for ClamAV: * Sanesecurity is an organization that maintains a number of such databases; in addition, they distribute and classify a number of similar databases from other parties, such as Porcupine, Julian Field, MalwarePatrol.Sanesecurit
Phishing, Scam and Malware signatures for ClamAV
* SecuriteInfo.com also provides additional signatures for ClamAV.SecuriteInfo.co
Add 4.000.000 signatures to ClamAV Antivirus
/ref> ClamAV Unofficial Signatures are mainly used by system administrators to filter email messages. Detections of these groups should be scored, rather than causing an outright block of the "infected" message.

Platforms

Linux, BSD

ClamAV is available for

and

-based operating systems. In most cases it is available through the distribution's repositories for installation. On Linux servers ClamAV can be run in daemon mode, servicing requests to scan files sent from other processes. These can include mail exchange programs, files on

Samba Samba () is a broad term for many of the rhythms that compose the better known Brazilian music genres that originated in the Afro-Brazilians, Afro Brazilian communities of Bahia in the late 19th century and early 20th century, It is a name or ...

shares, or packets of data passing through a proxy server. On Linux and BSD desktops ClamAV provides on-demand scanning of individual files, directories or the whole PC.

macOS

macOS Server has included ClamAV since version 10.4. It is used within the operating system's email service. A paid-for graphical user interface is available from Canimaan Software Ltd in the form of ''ClamXav''. Additionally, Fink, Homebrew and

MacPorts MacPorts, formerly DarwinPorts, is a package manager for macOS and Darwin. It is an open-source software project that aims to simplify the installation of other open source software. It is similar in function to Fink and the BSD ports collection ...

have ported ClamAV. Another program which uses the ClamAV engine on macOS, is Counteragent. Working alongside the Eudora Internet Mail Server program, Counteragent scans emails for viruses using ClamAV and also optionally provides spam filtering through

SpamAssassin Apache SpamAssassin is a computer program used for e-mail spam filtering. It uses a variety of spam-detection techniques, including DNS and fuzzy checksum techniques, Bayesian filtering, external programs, blacklists and online databases. It ...

OpenVMS

ClamAV for

is available for

DEC Alpha Alpha (original name Alpha AXP) is a 64-bit reduced instruction set computer (RISC) instruction set architecture (ISA) developed by Digital Equipment Corporation (DEC). Alpha was designed to replace 32-bit VAX complex instruction set computers ( ...

and

Itanium Itanium (; ) is a discontinued family of 64-bit computing, 64-bit Intel microprocessors that implement the Intel Itanium architecture (formerly called IA-64). The Itanium architecture originated at Hewlett-Packard (HP), and was later jointly dev ...

platforms. The build process is simple and provides basic functionality, including library, the clamscan utility, the clamd

, and freshclam for update.

Windows

There are

IA-32 IA-32 (short for "Intel Architecture, 32-bit", commonly called ''i386'') is the 32-bit version of the x86 instruction set architecture, designed by Intel and first implemented in the i386, 80386 microprocessor in 1985. IA-32 is the first incarn ...

and

x64 x86-64 (also known as x64, x86_64, AMD64, and Intel 64) is a 64-bit extension of the x86 instruction set. It was announced in 1999 and first available in the AMD Opteron family in 2003. It introduces two new operating modes: 64-bit mode an ...

variants of ClamAV available for Windows; additionally,

's Immunet uses ClamAV as its engine.

OS/2

A port of ClamAV is available for

OS/2 OS/2 is a Proprietary software, proprietary computer operating system for x86 and PowerPC based personal computers. It was created and initially developed jointly by IBM and Microsoft, under the leadership of IBM software designer Ed Iacobucci, ...

(including

eComStation eComStation or eCS is an operating system based on OS/2 Warp for the 32-bit x86 architecture. It was originally developed by Serenity Systems and Mensys BV under license from IBM. It includes additional applications, and support for new hardwa ...

and

ArcaOS ArcaOS is a Proprietary software, proprietary operating system based on OS/2, developed and marketed by Arca Noae, LLC under license from IBM. It was first released in 2017 and builds on OS/2 Warp 4.52 by adding support for new hardware, fixing ...

) with a native UI written in

REXX Rexx (restructured extended executor) is a high-level programming language developed at IBM by Mike Cowlishaw. Both proprietary and open-source software, open source Rexx interpreter (computing), interpreters exist for a wide range of comput ...

Graphical interfaces

Since ClamAV does not include a

graphical user interface A graphical user interface, or GUI, is a form of user interface that allows user (computing), users to human–computer interaction, interact with electronic devices through Graphics, graphical icon (computing), icons and visual indicators such ...

(GUI) but instead is run from the command line, a number of third-party developers have written GUIs for the application for various platforms and uses. These include: ClamTk 5

** ClamTk using gtk2-perl; project is named for the Tk libraries that were used when it began ** KlamAV for TDE (development of the original

KDE KDE is an international free software community that develops free and open-source software. As a central development hub, it provides tools and resources that enable collaborative work on its projects. Its products include the KDE Plasma gra ...

version was discontinued in 2009) ** wbmclamav is a webmin module to manage Clam AntiVirus *

** ClamXav is a port which includes a graphical user interfaces and has a "sentry" service which can watch for changes or new files in many cases. There is also an update and scanning scheduler through a

cron The cron command-line utility is a job scheduler on Unix-like operating systems. Users who set up and maintain software environments use cron to schedule jobs (commands or shell scripts), also known as cron jobs, to run periodically at fixed t ...

job facilitated by the graphical interface. ClamXav can detect malware specific to macOS, Unix, or Windows. The ClamXav application and the ClamAV engine are updated regularly. ClamXav is written and sold by Canimaan Software Ltd. ** Tiger Cache Cleaner is

shareware Shareware is a type of proprietary software that is initially shared by the owner for trial use at little or no cost. Often the software has limited functionality or incomplete documentation until the user sends payment to the software developer. ...

software which installs and presents a graphic interface for using ClamAV to scan for viruses, and provides other unrelated functions. *

** Immunet ** ClamWin ** CS Antivirus ** Graugon AntiVirus ** Clam Sentinel *

** ClamAV-GUI

ClamWin

ClamWin is a graphical user interface front-end ClamWin Pty Ltd. developed for ClamAV on

. Features include on-demand (user-started) scanning, automatic updates, scheduled scanning, and integration with

File Explorer File Explorer, previously known as Windows Explorer, is a file manager application and default desktop environment that is included with releases of the Microsoft Windows operating system from Windows 95 onwards. It provides a graphical user i ...

and

Microsoft Outlook Microsoft Outlook is a personal information manager software system from Microsoft, available as a part of the Microsoft 365 software suites. Primarily popular as an email client for businesses, Outlook also includes functions such as Calendari ...

. ClamWin does not provide on-access scanning. A Firefox add-on enables ClamWin to scan downloaded files. Several other extensions allow users to process downloaded files with any software and scan the files with ClamWin.

References

External links

* {{DEFAULTSORT:Clam Antivirus Antivirus software Antivirus software for Linux Cloud applications Cross-platform free software Free antivirus software Free software programmed in C Free security software