Scanning with ClamAV

ClamAV is a free, open-source utility for detecting malicious code in files. ClamAV can detect trojans, viruses, malware, and other potential threats.

Installation

To install ClamAV, run the following command:

Ubuntu / Debian:

apt install -y clamav 

CentOS / Fedora:

yum install -y clamav clamav-update

Updating the databases

Before scanning, we recommend updating the ClamAV signatures. To do this, run the following command:

systemctl stop clamav-freshclam.service ; freshclam ; systemctl start clamav-freshclam.service

This command stops the Freshclam service (to avoid a lock conflict), updates the signatures, and then starts Freshclam again. 

Scanning

Note that the scanner requires a significant amount of RAM. We recommend running it on systems with at least 1–1.5 GB of available RAM. If the server has no swap file, we recommend setting one up.

Usage examples

To scan a specific file, use:

clamscan file_name

To scan a directory and list only infected files, run:

clamscan -r -i /directory

To move infected files to a specified directory, run:

clamscan -r -i --move=/target_folder /folder_to_scan

If you want infected files to be deleted automatically when found (be careful!), use:

clamscan -r --remove /folder_to_scan