Clam AntiVirus (ClamAV) is a

free software Free software or libre software is computer software distributed under terms that allow users to run the software for any purpose as well as to study, change, and distribute it and any adapted versions. Free software is a matter of liberty, ...

, cross-platform antimalware toolkit able to detect many types of malware, including

viruses A virus is a submicroscopic infectious agent that replicates only inside the living cells Cell most often refers to: * Cell (biology), the functional basic unit of life Cell may also refer to: Locations * Monastic cell, a small room ...

. It was developed for

Unix Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, a ...

and has third party versions available for AIX, BSD,

HP-UX HP-UX (from "Hewlett Packard Unix") is Hewlett Packard Enterprise's proprietary implementation of the Unix operating system, based on Unix System V (initially System III) and first released in 1984. Current versions support HPE Integrit ...

Linux Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which i ...

macOS macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac (computer), Mac computers. Within the market of ...

OpenVMS OpenVMS, often referred to as just VMS, is a multi-user, multiprocessing and virtual memory-based operating system. It is designed to support time-sharing, batch processing, transaction processing and workstation applications. Customers using Ope ...

, OSF (Tru64) and Solaris. As of version 0.97.5, ClamAV builds and runs on Microsoft Windows. Both ClamAV and its updates are made available free of charge. One of its main uses is on

mail servers Within the Internet email system, a message transfer agent (MTA), or mail transfer agent, or mail relay is software that transfers electronic mail messages from one computer to another using SMTP. The terms mail server, mail exchanger, and MX host ...

as a server-side email virus scanner. Sourcefire, developer of intrusion detection products and the owner of

Snort Snort may refer to: * Nose-blowing * Sniffle * Nasal administration, the inhaling of drugs through the nose * Snort (software), a package for intrusion detection * Snort, a map-coloring game * Insufflation, the act of blowing, breathing, hissing, ...

, announced on 17 August 2007 that it had acquired the

trademarks A trademark (also written trade mark or trade-mark) is a type of intellectual property consisting of a recognizable sign, design, or expression that identifies products or services from a particular source and distinguishes them from ot ...

and

copyrights A copyright is a type of intellectual property that gives its owner the exclusive right to copy, distribute, adapt, display, and perform a creative work, usually for a limited time. The creative work may be in a literary, artistic, educati ...

to ClamAV from five key developers. Upon joining Sourcefire, the ClamAV team joined the Sourcefire Vulnerability Research Team (VRT). In turn, Cisco acquired Sourcefire in 2013. The Sourcefire VRT became Cisco Talos, and ClamAV development remains there.

Features

ClamAV includes a command-line scanner, automatic database updater, and a scalable multi-threaded daemon running on an anti-virus engine from a shared library. The application features a Milter interface for sent mail and on-demand scanning. It recognizes: *

ZIP Zip, Zips or ZIP may refer to: Common uses * ZIP Code, USPS postal code * Zipper or zip, clothing fastener Science and technology Computing * ZIP (file format), a compressed archive file format ** zip, a command-line program from Info-ZIP * Zi ...

RAR RAR or Rar may refer to: * Radio acoustic ranging, a non-visual technique for determining a ship's position at sea * "rar", the ISO 639-2 code for the Cook Islands Māori language * RAR (file format), a proprietary compressed archive file format in ...

Tar Tar is a dark brown or black viscosity, viscous liquid of hydrocarbons and free carbon, obtained from a wide variety of organic matter, organic materials through destructive distillation. Tar can be produced from coal, wood, petroleum, or peat. ...

, Gzip, Bzip2, OLE2,

Cabinet Cabinet or The Cabinet may refer to: Furniture * Cabinetry, a box-shaped piece of furniture with doors and/or drawers * Display cabinet, a piece of furniture with one or more transparent glass sheets or transparent polycarbonate sheets * Filing ...

CHM CHM may refer to: Biology and medicine * CHM, abbreviation for Clearing House Mechanism under the Convention on Biological Diversity * CHM, a human gene that encodes Rab escort protein 1 * Choroideremia, a retinal disease caused by mutations in the ...

, BinHex, and SIS formats * Most mail file formats * ELF and Portable Executable (PE) files compressed with

UPX UPX (Ultimate Packer for Executables) is a free and open source executable packer supporting a number of file formats from different operating systems. Compression UPX uses a data compression algorithm called UCL, which is an open-source im ...

, FSG, Petite, NsPack, wwpack32, MEW, and Upack, or obfuscated with SUE, Y0da Cryptor. *

Office Open XML file formats The Office Open XML file formats are a set of file formats that can be used to represent electronic office documents. There are formats for word processing documents, spreadsheets and presentations as well as specific formats for material ...

HTML The HyperText Markup Language or HTML is the standard markup language for documents designed to be displayed in a web browser. It can be assisted by technologies such as Cascading Style Sheets (CSS) and scripting languages such as JavaScri ...

, Rich Text Format (RTF) and

Portable Document Format Portable Document Format (PDF), standardized as ISO 32000, is a file format developed by Adobe in 1992 to present documents, including text formatting and images, in a manner independent of application software, hardware, and operating syste ...

(PDF). The ClamAV virus database is updated at least every four hours and as of 10 February 2017 contained over 5,760,000 virus signatures with the daily update Virus DB number at 23040.

Effectiveness

ClamAV was tested against other antivirus products on ''

Shadowserver Shadowserver Foundation is a nonprofit security organization that gathers and analyzes data on malicious Internet activity (including malware, botnets, and computer fraud), sends daily network reports to subscribers, and works with law enforcemen ...

''. In 2011, Shadowserver tested over 25 million samples against ClamAV and numerous other antivirus products. Out of the 25 million samples tested, ClamAV scored 76.60% ranking 12 out of 19, a higher rating than some much more established competitors. In the 2008 AV-TEST comparison of antivirus tools, ClamAV scored poorly in on-demand detection, avoiding false positives, and rootkit detection. In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28%. In 2022 Splunk conducted an efficacy study involving ~400,000 malware samples sourced from MalwareBazaar. The study concluded ClamAV is 59.94% effective overall at detecting commodity malware.

Unofficial databases

The ClamAV engine can be reliably used to detect several kinds of files. In particular, some

phishing Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...

emails can be detected using antivirus techniques. However, false positive rates are inherently higher than those of traditional malware detection. There are several unofficial databases for ClamAV: * Sanesecurity is an organization that maintains a number of such databases; in addition they distribute and classify a number of similar databases from other parties, such as Porcupine, Julian Field, MalwarePatrol.Sanesecurit
Phishing, Scam and Malware signatures for ClamAV
* SecuriteInfo.com also provides additional signatures for ClamAV.SecuriteInfo.co
Add 4.000.000 signatures to ClamAV Antivirus
/ref> ClamAV Unofficial Signatures are mainly used by system administrators to filter email messages. Detections of these groups should be scored, rather than causing an outright block of the "infected" message.

Platforms

Linux, BSD

ClamAV is available for

and BSD-based operating systems. In most cases it is available through the distribution's repositories for installation. On Linux servers ClamAV can be run in daemon mode, servicing requests to scan files sent from other processes. These can include mail exchange programs, files on

Samba Samba (), also known as samba urbano carioca (''urban Carioca samba'') or simply samba carioca (''Carioca samba''), is a Brazilian music genre that originated in the Afro-Brazilian communities of Rio de Janeiro in the early 20th century. Havi ...

shares, or packets of data passing through a proxy server. On Linux and BSD desktops ClamAV provides on-demand scanning of individual files, directories or the whole PC.

macOS

macOS Server has included ClamAV since version 10.4. It is used within the operating system's email service. A paid-for graphical user interface is available from Canimaan Software Ltd in the form of ''ClamXav''. Additionally, Fink,

Homebrew Homebrewing mainly refers to small-scale, non-commercial manufacture of a drink, typically beer. Homebrew or home brew may also refer to: Computing * Homebrew Computer Club * Homebrew (package manager), for macOS and Linux * Homebrew (video game ...

and MacPorts have ported ClamAV. Another program which uses the ClamAV engine on macOS, is Counteragent. Working alongside the Eudora Internet Mail Server program, Counteragent scans emails for viruses using ClamAV and also optionally provides spam filtering through SpamAssassin.

OpenVMS

ClamAV for

is available for DEC Alpha and Itanium platforms. The build process is simple and provides basic functionality, including library, the clamscan utility, the clamd daemon, and freshclam for update.

Windows

There are IA-32 and x64 variants of ClamAV available for Windows; additionally, Cisco's Immunet uses ClamAV as its engine.

OS/2

A port of ClamAV is available for

OS/2 OS/2 (Operating System/2) is a series of computer operating systems, initially created by Microsoft and IBM under the leadership of IBM software designer Ed Iacobucci. As a result of a feud between the two companies over how to position OS/2 ...

(including

eComStation eComStation or eCS is an operating system based on OS/2 Warp for the 32-bit x86 architecture. It was originally developed by Serenity Systems and Mensys BV under license from IBM. It includes additional applications, and support for new hard ...

and

ArcaOS ArcaOS is an operating system based on OS/2, developed and marketed by Arca Noae, LLC under license from IBM. It was codenamed Blue Lion during its development. It builds on OS/2 Warp 4.52 by adding support for new hardware, fixing defects and l ...

) with a native UI written in REXX.

Graphical interfaces

Since ClamAV does not include a

graphical user interface The GUI ( "UI" by itself is still usually pronounced . or ), graphical user interface, is a form of user interface that allows User (computing), users to Human–computer interaction, interact with electronic devices through graphical icon (comp ...

(GUI) but instead is run from the command line, a number of third-party developers have written GUIs for the application for various platforms and uses. These include: ClamTk 5

** ClamTk using gtk2-perl; project is named for the Tk libraries that were used when it began **KlamAV for TDE (development of the original KDE version was discontinued in 2009). **wbmclamav is a

webmin module Webmin is a powerful and flexible web-based server management control panel for Unix-like systems. Webmin allows the user to configure operating system internals, such as users, disk quotas, services or configuration files, as well as modify an ...

to manage Clam AntiVirus *

**ClamXav is a port which includes a graphical user interfaces and has a "sentry" service which can watch for changes or new files in many cases. There is also an update and scanning scheduler through a cron job facilitated by the graphical interface. ClamXav can detect malware specific to macOS, Unix, or Windows. The ClamXav application and the ClamAV engine are updated regularly. ClamXav is written and sold by Canimaan Software Ltd. **Tiger Cache Cleaner is shareware software which installs and presents a graphic interface for using ClamAV to scan for viruses, and provides other unrelated functions. * Microsoft Windows ** Immunet ** ClamWin ** CS Antivirus ** Graugon AntiVirus **

Clam Sentinel Clam is a common name for several kinds of bivalve molluscs. The word is often applied only to those that are edible and live as infauna, spending most of their lives halfway buried in the sand of the seafloor or riverbeds. Clams have two shel ...

** ClamAV-GUI

ClamWin

ClamWin is a graphical user interface front-end ClamWin Pty Ltd. developed for ClamAV on Microsoft Windows. Features include on-demand (user-started) scanning, automatic updates, scheduled scanning, and integration with

File Explorer File Explorer, previously known as Windows Explorer, is a file manager application that is included with releases of the Microsoft Windows operating system from Windows 95 onwards. It provides a graphical user interface for accessing the file ...

and

Microsoft Outlook Microsoft Outlook is a personal information manager software system from Microsoft, available as a part of the Microsoft Office and Microsoft 365 software suites. Though primarily an email client, Outlook also includes such functions as c ...

. ClamWin does not provide on-access scanning. A

Firefox add-on Add-on is the Mozilla term for software modules that can be added to the Firefox web browser and related applications. Mozilla hosts them on its official add-on website. Browser extensions are the primary type of add-on. In 2017, Mozilla enacted ...

enables ClamWin to scan downloaded files. Several other extensions allow users to process downloaded files with any software and scan the files with ClamWin.

Real-time file scanning

, ClamAV (versions 0.99 and later) supports real-time protection via the Fanotify add-on for the Linux kernel (version 3.8 and later.) Alternatively, one could use ClamFS (for any

Unix-like A Unix-like (sometimes referred to as UN*X or *nix) operating system is one that behaves in a manner similar to a Unix system, although not necessarily conforming to or being certified to any version of the Single UNIX Specification. A Unix-li ...

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ef ...

supporting FUSE). On Microsoft Windows, a free, open-source app called Clam Sentinel detects file changes and scans modified files using ClamWin. It works with Windows 98 and later. In addition to on-access scanning, it features optional system change messages and proactive heuristic protection.

Patent lawsuit

In 2008, Barracuda Networks was sued by Trend Micro for its distribution of ClamAV as part of a security package. Trend Micro claimed that Barracuda's utilization of ClamAV infringes on a

software patent A software patent is a patent on a piece of software, such as a computer program, Library (computing), libraries, user interface, or algorithm. Background A patent is a set of exclusionary rights granted by a State (polity), state to a patent h ...

for filtering viruses on an Internet gateway. The free software community responded in part by calling for a

boycott A boycott is an act of nonviolent, voluntary abstention from a product, person, organization, or country as an expression of protest. It is usually for moral, social, political, or environmental reasons. The purpose of a boycott is to inflict s ...

against Trend Micro. The boycott was also endorsed by the

Free Software Foundation The Free Software Foundation (FSF) is a 501(c)(3) non-profit organization founded by Richard Stallman on October 4, 1985, to support the free software movement, with the organization's preference for software being distributed under copyleft ("s ...

. Barracuda Networks counter-sued with IBM-obtained patents in July 2008. On May 19, 2011, the U.S. Patent and Trademark Office issued a Final Rejection in the reexamination of Trend Micro's U.S. patent 5,623,600.

References

External links

* {{DEFAULTSORT:Clam Antivirus Antivirus software Antivirus software for Linux Cloud applications Cross-platform free software Free antivirus software Free software programmed in C Free security software