ClamAV

ClamAV was initially released with version 0.10 on May 8, 2002, by Polish university student Tomasz Kojm.^[4] In 2007, it was acquired by Sourcefire,^[5] which in turn was acquired by Cisco in 2013^[6] and now operates under its Talos cybersecurity division.

In 2008, Barracuda Networks was sued by Trend Micro for its distribution of ClamAV as part of a security package.^[7] Trend Micro claimed that Barracuda's utilization of ClamAV infringes on a software patent for filtering viruses on an Internet gateway. The free software community responded in part by calling for a boycott against Trend Micro. The boycott was also endorsed by the Free Software Foundation.^[8] Barracuda Networks counter-sued with IBM-obtained patents in July 2008.^[9] On May 19, 2011, the U.S. Patent and Trademark Office issued a Final Rejection^[10] in the reexamination of Trend Micro's U.S. patent 5,623,600.^[11]

ClamAV includes a command-line scanner, automatic database updater, and a scalable multi-threaded daemon running on an anti-virus engine from a shared library.^[2] The application features a Milter interface for sent mail and on-demand scanning. It recognizes:

• ZIP, RAR, Tar, Gzip, Bzip2, OLE2, Cabinet, CHM, BinHex, and SIS formats
• Most mail file formats
• ELF and Portable Executable (PE) files compressed with UPX, FSG, Petite, NsPack, wwpack32, MEW, and Upack, or obfuscated with SUE, Y0da Cryptor.
• Office Open XML file formats, HTML, Rich Text Format (RTF) and Portable Document Format (PDF).^[2]

The ClamAV virus database is updated at least every four hours and as of 10 February 2017 contained over 5,760,000 virus signatures^[12] with the daily update Virus DB number at 23040.^[13][14]

In older Linux application versions, ClamAV did support real-time protection via the Fanotify add-on for the Linux kernel (version 3.8 and later.)^[15] Alternatively, one could use ClamFS (for any Unix-like operating system supporting FUSE).

Nowadays, the Real-Time Protection in Linux Systems, is provided through ClamAV's ClamOnAcc application (under the name of "On-Access Scanning") – which uses Clamd to provide real-time protection by scanning files when they are accessed.^[16]

In other words, the On-Access Scanner can detect and prevent access to malicious files based on the verdict received from Clamd.^[16] By default, it operates in "notify-only mode", alerting users of any threats detected without actively blocking file access.^[16]

Enabling "prevention mode" can considerably impact performance, especially in commonly accessed directories, so it is advised to use it judiciously.^[16]

In order to use ClamOnAcc, users need to first run clamd and then start the On-Access Scanner as root (to leverage its kernel event detection and intervention capabilities).^[16]

Configuration for On-Access Scanning is primarily done through clamd.conf, with additional options available in the On-Access Scanning User Guide.^[16]

Users can run multiple instances of ClamOnAcc simultaneously with different configurations, allowing for customized protection settings for various directories.^[16]

ClamOnAcc (v0.102+) is a client application that operates alongside clamd (the ClamAV daemon), to perform On-Access Scanning.^[16]

Regarding previous versions that were meant for Microsoft Windows, a free, open-source app called Clam Sentinel did use to detect file changes and scanned modified files using ClamWin.^[17] It did work with Windows 98 and later. In addition to on-access scanning, it used to feature optional system change messages and proactive heuristic protection.^[18]

In the 2008 AV-TEST comparison of antivirus tools, ClamAV scored poorly in on-demand detection, avoiding false positives, and rootkit detection.^[19]

In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28%.^[20]

In 2022 Splunk conducted an efficacy study involving 416,561 malware samples sourced from MalwareBazaar, bucketed as follows: 106135 Banking Trojans (trojans targeted towards stealing financial information); 26875 Botnets (malware for making the victim a part of a botnet); 190371 Information Stealers (programs designed to steal client information. E.g. Keyloggers); 52422 Loaders (program that loads one or more other malicious programs – that is, a stager that fetches harmful things directly into memory); 1321 Miners (crypto currency miners); 30251 RATs (Remote access tools. E.g. Backdoors); and 8273 Trojans (a generic multipurpose malware that harms the user in different ways – generally disguises itself and delivered by tricking the user). Splunk's study concluded ClamAV was 59.94% effective overall at detecting commodity malware – being able to detect 249,696/416,561 samples.^[21]

In that same study, ClamAV performed relatively well at detecting certain types of malware in certain types of files (E.g. DOCX files, DIL files, ELF files, DOC files and EXE files), but was less effective in detecting malware in JAR files, JS files, VBS files, Z files, RAR files, and XLSB files. In addition, ClamAV performed well to detect a few top level categories of malware like Trojans & Botnets but performed poorly on other malware types like Crypto Miners, RATs and Info Stealers.^[22]

The ClamAV engine can be reliably used to detect several kinds of files. In particular, some phishing emails can be detected using antivirus techniques. However, false positive rates are inherently higher than those of traditional malware detection.^[23]

There are several unofficial databases for ClamAV:

• Sanesecurity is an organization that maintains a number of such databases; in addition they distribute and classify a number of similar databases from other parties, such as Porcupine, Julian Field, MalwarePatrol.^[24]
• SecuriteInfo.com also provides additional signatures for ClamAV.^[25]

ClamAV Unofficial Signatures are mainly used by system administrators to filter email messages.^[26] Detections of these groups should be scored, rather than causing an outright block of the "infected" message.^[24]

ClamAV is available for Linux and BSD-based operating systems.^[2] In most cases it is available through the distribution's repositories for installation.

On Linux servers ClamAV can be run in daemon mode, servicing requests to scan files sent from other processes. These can include mail exchange programs, files on Samba shares, or packets of data passing through a proxy server.

On Linux and BSD desktops ClamAV provides on-demand scanning of individual files, directories or the whole PC.^[2]

macOS Server has included ClamAV since version 10.4. It is used within the operating system's email service. A paid-for graphical user interface is available from Canimaan Software Ltd^[27] in the form of ClamXav.^[28] Additionally, Fink, Homebrew and MacPorts have ported ClamAV.

Another program which uses the ClamAV engine on macOS, is Counteragent. Working alongside the Eudora Internet Mail Server program, Counteragent scans emails for viruses using ClamAV and also optionally provides spam filtering through SpamAssassin.

ClamAV for OpenVMS is available for DEC Alpha and Itanium platforms. The build process is simple and provides basic functionality, including library, the clamscan utility, the clamd daemon, and freshclam for update.^[29]

There are IA-32 and x64 variants of ClamAV available for Windows; additionally, Cisco's Immunet uses ClamAV as its engine.^[30]

A port of ClamAV is available for OS/2 (including eComStation and ArcaOS) with a native UI written in REXX.^[31][32]

Since ClamAV does not include a graphical user interface (GUI) but instead is run from the command line, a number of third-party developers have written GUIs for the application for various platforms and uses.

These include:

 

• Linux
  • ClamTk using gtk2-perl; project is named for the Tk libraries that were used when it began^[33][34][35]
  • KlamAV for TDE (development of the original KDE version was discontinued in 2009^[36])
  • wbmclamav is a webmin module to manage Clam AntiVirus^[37]
• macOS
  • ClamXav is a port which includes a graphical user interfaces and has a "sentry" service which can watch for changes or new files in many cases. There is also an update and scanning scheduler through a cron job facilitated by the graphical interface. ClamXav can detect malware specific to macOS, Unix, or Windows. The ClamXav application and the ClamAV engine are updated regularly.^[38] ClamXav is written and sold by Canimaan Software Ltd.^[27]
  • Tiger Cache Cleaner is shareware software which installs and presents a graphic interface for using ClamAV to scan for viruses, and provides other unrelated functions.
• Microsoft Windows
  • Immunet
  • ClamWin
  • CS Antivirus^[39]
  • Graugon AntiVirus^[39]
  • Clam Sentinel
• OS/2
  • ClamAV-GUI^[31]

 

ClamWin is a graphical user interface front-end ClamWin Pty Ltd. developed for ClamAV on Microsoft Windows. Features include on-demand (user-started) scanning, automatic updates, scheduled scanning, and integration with File Explorer and Microsoft Outlook. ClamWin does not provide on-access scanning. A Firefox add-on enables ClamWin to scan downloaded files.^[40][41] Several other extensions allow users to process downloaded files with any software and scan the files with ClamWin.^{[42][43][44][45]}

• List of antivirus software
• List of free and open-source software packages
• Software patents and free software

• An interview with ClamAV founder Tomasz Kojm archived version

 

Wikimedia Commons has media related to ClamAV.

• Official website