Using ClamAV to detect viruses on Linux

The ClamAV control can identify and relocate files on Linux that have been infected past viruses, but not remove the viruses themselves.

Digital bugs amid binary code. [security threats / malware / breach / hack / attack]
WhataWin / Getty Images

One popular and easy-to-utilise tool for detecting virus infections on Linux systems is ClamAV. It'southward open source and gratis, and runs on many Linux systems, Ubuntu and Fedora included. In this post, we'll take a await at how to install and use the tool on Ubuntu, Linux Mint, and related systems.

Installing ClamAV on Linux Mint

The first step for installing ClamAV on Ubuntu, Mint, and related distros should be to update your arrangement.

$ sudo apt update && sudo apt upgrade -y

Afterwards that, you can install ClamAV and verify the installation with commands like these:

$ sudo apt-get install clamav clamav-daemon $ clamscan --version ClamAV 0.103.5/26469/Wed Mar  2 04:27:25 2-22

ClamAV commands

ClamAV'southward tools are clamscan to practise the scanning and freshclam to update the list of known virus signatures.

To start running freshclam as a service, you lot should run a command like this:

$ sudo systemctl start clamav-freshclam

Using the freshclam service

To update the virus signatures, you tin can employ thefreshclam tool like this:

$ sudo freshclam ClamAV update process started at Thu Mar  iii 11:58:21 2022 daily.cld database is upwardly-to-date (version: 26470, sigs: 1975358, f-level: 90, builder: raynman) main.cvd database is upward-to-appointment (version: 62, sigs: 6647427, f-level: xc, architect: sigmgr) bytecode.cvd database is upwards-to-date (version: 333, sigs: 92, f-level: 63, builder: awillia2)

To view the freshclam service, use a control like this:

$ systemctl | grep clam   clamav-freshclam.service           loaded active running ClamAV virus database updater

You can also apply the -d (or --deamon) option with freshclam. It volition so default to running 12 checks a day. The process y'all encounter should look like this:

$ ps -ef | grep freshclam clamupd+ 2536188       i  0 Mar03 ?        00:00:02 /usr/bin/freshclam -d --foreground=true

This means that you lot volition go frequent updates of the virus signatures without having to install them yourself.

ClamAV options

ClamAV is extremely easy to use and examines individual files in whatever directory yous point it at. It will report on the files and directories scanned and the number of infections. Depending on how large a directory you inquire it to scan, it can report results fairly quickly or take hours to run.

Here are some of the options and what they practise:

  • --verbose: shows the version of the tool
  • --infected: displays only infected files
  • --quiet: only lists mistake messages
  • --remove: removes infected files
  • --recursive: ensures that all subdirectories in the directory will exist scanned
  • --move: moves infected files into the specified directory

A command like that shown below examines a single user account. As y'all can encounter, it took nearly half an 60 minutes to run, scanned 940 directories and virtually 34,000 files, merely establish no infected files. Without a file system location, clamscan will look through the current file system.

$ clamscan --infected --remove --recursive /home/jdoe  ----------- Browse SUMMARY ----------- Known viruses: 8607279 Engine version: 0.103.v Scanned directories: 940 Scanned files: 33946 Infected files: 0 Data scanned: 3147.79 MB Information read: 1735.xv MB (ratio i.81:one) Time: 1734.069 sec (28 m 54 s) Start Date: 2022:03:02 xiv:47:09 Terminate Appointment:   2022:03:02 fifteen:16:03

The clamscan study also shows y'all how long it took to run forth with both start and end times.

Without the recursive option, clamscan would just look at the files in the specified directly, merely not become any more deeply into the file organisation. In the command below, clamscan did not look at subdirectories, so it only scanned 39 files.

$ clamscan --infected --remove /habitation/jdoe  ----------- SCAN SUMMARY ----------- Known viruses: 8607279 Engine version: 0.103.5 Scanned directories: 1 Scanned files: 39 Infected files: 0 Data scanned: 242.xxx MB Data read: 164.58 MB (ratio 1.47:1) Time: 107.981 sec (1 m 47 southward) Kickoff Date: 2022:03:02 15:18:47 Terminate Appointment:   2022:03:02 15:twenty:35

Go on in listen that ClamAV does not disinfect files. It only removes them from the system or moves them to a specified location. It as well doesn't watch for infections. It scans when you lot ask and otherwise remains fallow.

To view version data, use the -v (or --version) option.

$ clamscan --version ClamAV 0.103.five/26470/Thu Mar  3 04:49:xvi 2022

Run the same command the next day and the report should brandish updates:

$ clamscan --version ClamAV 0.103.v/26471/Fri Mar  4 04:24:47 2022

The numbers 26470 and 26471 in the above output testify the version of the signatures that allow clamscan to recognize the viruses while the version of the clamscan tool itself is 0.103.v.

The clamscan report below includes some information that can assistance yous see that updates are being made along with details on what the tool detected:

$ sudo clamscan --infected --remove --recursive /home/nemo  ----------- SCAN SUMMARY ----------- Known viruses: 8607429	<== larger number confirms updates Engine version: 0.103.five	<== release Scanned directories: 39 Scanned files: 2145 Infected files: 	<== no infected files Information scanned: 4.68 MB Data read: 9.21 MB (ratio 0.51:ane) Time: 52.778 sec (0 m 52 s)	<== under 1 minute Kickoff Appointment: 2022:03:04 ten:15:43 End Date:   2022:03:04 x:sixteen:36

I important affair to continue in mind is that clamscan can only read files that the user running the tool can read, so using sudo is generally required.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are peak of heed.

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English language to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she'south chasing the bears abroad from her bird feeders.

Copyright © 2022 IDG Communications, Inc.