apt update<\/code><\/pre>\n\n\n\napt install clamav clamav-daemon -y<\/pre>\n\n\n\nUpdate the ClamAV Singature Database<\/h3>\n\n\n\n
Once the installation is complete, you should update the ClamAV signatures.<\/p>\n\n\n\n
Stop the clamav-freshclam service and run the freshclam command to manually update the signatures database.<\/p>\n\n\n\n
systemctl stop clamav-freshclam<\/code><\/pre>\n\n\n\nfreshclam<\/code><\/pre>\n\n\n\nOnce the virus database update is done, start the clamav-freshclam service so it keeps updating the signature database in the background whenever.<\/p>\n\n\n\n
systemctl start clamav-freshclam<\/code><\/pre>\n\n\n\nYou are now ready to use ClamAV to protect your system against viruses.<\/p>\n\n\n\n
ClamAV comes with a command line utility called clamscan<\/strong> that scans files and directories for viruses.<\/p>\n\n\n\nTo see the clamscan command line usage, run either of the commands below.<\/p>\n\n\n\n
\n- clamscan –help<\/li>\n\n\n\n
- man clamscan<\/li>\n<\/ul>\n\n\n\n
Clamscan CLI Options and Example Usage<\/h3>\n\n\n\n
From the man pages, the clamscan command syntax is:<\/p>\n\n\n\n
clamscan [options] [file\/directory\/-]<\/code><\/pre>\n\n\n\nSome of the clamscan command options and their example usage is illustrated below;<\/p>\n\n\n\n
\n-h, --help<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Print help information and exit.\n # clamscan -h<\/strong> \n-V, --version<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Print version number and exit.\n # clamscan -V<\/strong>\n ClamAV 0.100.1\/25021\/Tue Oct 9 15:52:08 2018<\/strong>\n--no-summary<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Do not display summary at the end of scanning.\n # clamscan --no-summary \/home\/<\/strong>\n-i, --infected<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Only print infected files.\n # clamscan -i \/home\/<\/strong>\n-o, --suppress-ok-results<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Skip printing OK files \n--bell<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Sound bell on virus detection.\n # clamscan -r --bell -i \/home<\/strong>\n-d FILE\/DIR, --database=FILE\/DIR<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Load virus database from FILE or load all virus database files from DIR.\n # clamscan -d \/tmp\/newclamdb -r \/tmp<\/strong>\n-l FILE, --log=FILE<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Save scan report to FILE.\n-r, --recursive<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Scan directories recursively. All the subdirectories in the given directory will be scanned.\n # clamscan -r --remove \/<\/strong>\n-f FILE, --file-list=FILE<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Scan files listed line by line in FILE. \n--remove[=yes\/no(*)]<\/strong>\n\u00a0\u00a0\u00a0\u00a0 Remove infected files. Be careful as this removes file completely.\n #\u00a0clamscan -r --remove \/home\/USER<\/strong>\n<\/code>--move=DIRECTORY<\/strong>\n Move infected files into DIRECTORY. Directory must be writable for the user or unprivileged user running clamscan.\n # clamscan -r --move=\/home\/USER\/VIRUS \/home\/<\/strong>\n--copy=DIRECTORY<\/strong>\n Copy infected files into DIRECTORY. Directory must be writable for the user or unprivileged user running clamscan.\n # clamscan -r --copy=\/home\/USER\/VIRUS \/home\/<\/strong>\n<\/code><\/pre>\n\n\n\nNote that most of the options are simple switches which enable or disable some features. Options marked with [=yes\/no(*)] can be optionally followed by =yes <\/strong>or =no. <\/strong>If they get called without the boolean argument the scanner will assume ‘yes’. The asterisk marks the default internal setting for a given option.<\/p>\n\n\n\nFor a comprehensive list of options, check the clamscan man pages<\/p>\n\n\n\n
man clamscan<\/code><\/pre>\n\n\n\nClamAV Return Codes<\/h3>\n\n\n\n
The following are the exit return codes for ClamAV.<\/p>\n\n\n\n
\n- 0 : No virus found.<\/li>\n\n\n\n
- 1 : Virus(es) found.<\/li>\n\n\n\n
- 2 : Some error(s) occured.<\/li>\n<\/ul>\n\n\n\n
Before we can wrap up this tutorial, it is good to understand that clamscan can be CPU intensive. To limit the clamscan CPU time to certain levels, you can use two tools; nice<\/strong> and cpulimit<\/strong> commands.