Knowledgebase

ClamAV is a widely-used, open-source antivirus engine capable of detecting a broad range of malware, including threats commonly targeting Linux mail servers and web hosting environments.

Prerequisites

• Ubuntu 22.04/24.04 or Debian 11/12 VPS
• Root or sudo access
• At least 2 GB RAM recommended (virus definitions consume meaningful memory)

Step 1 — Install ClamAV

sudo apt update
sudo apt install clamav clamav-daemon -y

Step 2 — Update Virus Definitions

sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam

Step 3 — Enable Automatic Definition Updates

sudo systemctl enable clamav-freshclam

By default, freshclam checks for updates periodically without further configuration needed.

Step 4 — Run a Manual Scan

sudo clamscan -r /var/www

-r scans recursively through subdirectories.

Scanning and Automatically Removing Infected Files (Use with Caution)

sudo clamscan -r --remove /var/www

Consider reviewing results without --remove first, to avoid deleting a legitimate file incorrectly flagged as a false positive.

Scanning with Detailed Logging

sudo clamscan -r --infected --log=/var/log/clamav/scan.log /var/www

--infected shows only infected files in the output, reducing noise from thousands of clean-file confirmations.

Scheduling Regular Scans

sudo crontab -e

0 3 * * 0 clamscan -r --infected --log=/var/log/clamav/weekly-scan.log /var/www /home

Scanning Email Attachments (For Mail Servers)

If running a mail server, integrate ClamAV with your MTA to scan attachments in real time — this typically involves configuring clamav-milter alongside Postfix; consult ClamAV's mail integration documentation for exact setup matching your MTA version.

Running ClamAV as a Persistent Daemon (Faster Repeated Scans)

sudo systemctl enable --now clamav-daemon

Using clamdscan instead of clamscan leverages the already-running daemon with loaded definitions, significantly faster for repeated scans:

sudo clamdscan -r /var/www

Excluding Directories from Scanning

sudo clamscan -r --exclude-dir=^/var/www/node_modules /var/www

Useful for excluding large, low-risk directories (like dependency folders) to speed up scans.

Handling a Detected Infection

1. Do not immediately delete the file without understanding what it is and how it got there
2. Investigate how the file arrived (upload vulnerability, compromised account)
3. Consider the broader implications — see How to Recover from Ransomware or a Compromised VPS if this indicates a genuine compromise, not an isolated upload

Common Errors

"ERROR: Can't open file" during scan — usually a permissions issue; run the scan with sufficient privileges, or check the specific file's ownership.

High memory usage from freshclam/clamd — expected, since virus definitions are loaded into memory; ensure your VPS has adequate RAM, or consider running scans on a schedule rather than the persistent daemon on very small VPS plans.

Best Practices

• Keep virus definitions updated automatically via freshclam
• Schedule regular scans, especially for directories accepting user uploads
• Review flagged files carefully before automatic removal

Continue Reading

• How to Detect and Remove Rootkits on a Linux VPS
• How to Recover from Ransomware or a Compromised VPS
• VPS Security Checklist for Beginners

Browse more articles in Advanced Security & Compliance.