ClamAV

ClamAV
Original authorTomasz Kojm
DeveloperCisco Talos
Release8 May 2002; 24 years ago (2002-05-08)
Stable release
1.5.4 Edit this on Wikidata / 7 August 2026
Preview release
1.5.0-beta Edit this on Wikidata / 1 April 2025
Written inC, C++, Rust
Operating systemUnix, AIX, BSD, HP-UX, Linux, macOS, OpenVMS, Tru64 UNIX, Windows, Haiku
TypeAntivirus software
LicenseGPL-2.0-only
Websitewww.clamav.net
Repository

ClamAV (Clam AntiVirus) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It is developed by Cisco Talos and licensed under version 2 of the GNU General Public License. The project describes ClamAV as designed especially for scanning email on mail gateways rather than as a traditional antivirus or endpoint security suite. Its scanning engine is provided as a shared library that other software can embed, together with a command-line scanner, a multi-threaded scanning daemon and an automatic signature database updater. Both ClamAV and its updates are made available free of charge. One of its main uses is on mail servers as a server-side email virus scanner.

ClamAV was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, OSF (Tru64), Solaris and Haiku. The developers regularly test current releases on Linux, FreeBSD, macOS and Microsoft Windows.

Tomasz Kojm released the first version in May 2002. Sourcefire acquired the project in 2007, and Cisco acquired Sourcefire in 2013. Version 1.0, published in November 2022 after twenty years of 0.x releases, was designated a long-term support release.

History

ClamAV was initially released with version 0.10 on 8 May 2002, by Polish university student Tomasz Kojm. Kojm had planned to call the program TurtleAV before settling on ClamAV, a reference to clams as efficient filter feeders. The first public release included a patch for Amavis, then the most popular content filter used with virus scanners, and FreshClam, the signature database updater that the project still uses. Kojm hosted the virus databases on servers at his college and his former secondary school in Poland, and demand after the release caused denial-of-service conditions on those servers. He received more than 50 emails and many software patches within hours of announcing the release.

Linux Journal chose ClamAV in the Security Tool category of its 2004 Editors' Choice Awards. Contributing editor Reuven Lerner wrote that ClamAV was competing strongly with commercial virus scanners and that, combined with SpamAssassin, it had sharply reduced unwanted mail on his server; the magazine also reported that Linux administrators found ClamAV's database updates kept pace with or beat those of proprietary products.

On 17 August 2007, Sourcefire, the developer of the Snort intrusion detection system, announced that it had acquired the ClamAV project and its trademarks, together with the copyrights held by the five principal members of the development team, including Kojm. The team members became Sourcefire employees and continued to manage the project day to day, and Sourcefire said it would begin offering training and support services for ClamAV users. At the time, Sourcefire said that nearly one million unique IP addresses in 38 countries were downloading ClamAV signature updates each day. Sourcefire acquired Immunet in 2011 and integrated ClamAV into Immunet's consumer antimalware product for Windows.

In June 2012, Kojm and three other longtime team members, Alberto Wu, Luca Gibelli and Edwin Török, announced that they were leaving Sourcefire to work on new projects. Development passed to members of Sourcefire's Vulnerability Research Team.

Cisco agreed to acquire Sourcefire for US$2.7 billion in July 2013 and completed the purchase in October 2013, stating that it would continue to support Snort, ClamAV and other open-source projects. ClamAV now operates under Cisco's Talos cybersecurity division.

Patent lawsuit

In 2008, Barracuda Networks was sued by Trend Micro for its distribution of ClamAV as part of a security package. Trend Micro claimed that Barracuda's utilization of ClamAV infringes on a software patent for filtering viruses on an Internet gateway. The free software community responded in part by calling for a boycott against Trend Micro. The boycott was also endorsed by the Free Software Foundation. Barracuda Networks counter-sued with IBM-obtained patents in July 2008. On 19 May 2011, in an ex parte reexamination of Trend Micro's U.S. patent 5,623,600, the U.S. Patent and Trademark Office issued a final rejection of the patent's claims.

Development

ClamAV's source code is maintained by Cisco Talos in a public GitHub repository, which also hosts the project's issue tracker. In 2021 the project moved bug reporting from its own Bugzilla instance to GitHub Issues, and as of 2022 the project was led by Micah Snyder. Security vulnerabilities are reported privately under the project's security policy rather than through the public issue tracker. The project has adopted the Rust programming language for new development, and since version 0.105 the Rust toolchain has been required to compile ClamAV. Version 0.104 completed the move of the build system to CMake, removing the earlier Autotools build.

ClamAV's file parsers have been the subject of a number of security advisories, and Cisco's Product Security Incident Response Team publishes advisories for ClamAV vulnerabilities that affect Cisco products. In January 2025 Cisco patched a denial-of-service vulnerability for which proof-of-concept exploit code was publicly available. Security releases 1.5.3 and 1.4.5, published in July 2026, fixed seven vulnerabilities in the scanner, including a flaw in the FSG unpacker present in builds dating to 2004. In August 2026 Cisco disclosed seven further vulnerabilities in ClamAV's handling of ZIP, XAR, Mach-O, PDF, GPT and PESpin-packed files that could allow a remote attacker to terminate the scanning process by submitting a crafted file. Proof-of-concept code was public for two of the ZIP flaws; Cisco reported no evidence of exploitation, and the vulnerabilities were fixed in version 1.5.4, released on 7 August 2026.

Release history

ClamAV used 0.x version numbers for its first twenty years. Version 0.96, released in March 2010, added bytecode signatures; version 0.99, released in December 2015, added support for YARA rules and PCRE and improved on-access scanning. Version 0.100.0, released in 2018 after about two years of development, changed how the engine handles files nested inside containers and how wildcard signatures work. Version 0.101.0, released in December 2018, made a backward-incompatible change to the libclamav programming interface and added support for RAR5 archives.

Version 1.0.0 was published on 28 November 2022. Version 1.4, published on 15 August 2024, added extraction of ALZ and LHA/LZH archives. Version 1.5, published on 7 October 2025, added new scanning callback interfaces, support for .cvd.sign signature files, and a file type for identifying artificial intelligence model files.

Long-term support

In September 2021, alongside version 0.104.0, the project introduced a long-term support (LTS) program and retroactively designated version 0.103, first released on 14 September 2020, as its first LTS release. Each LTS feature release receives critical patch versions for at least three years from its first publication, and access to signature downloads for one further year so that operating system distributions can continue to backport security fixes. A new LTS release is designated approximately every two years; versions 1.0 and 1.4 were later given LTS status. Regular feature releases receive critical patches for at least four months after the next feature release is published, or until the release after that one appears.

The additional year of signature access was added in 2023. At the same time, the project extended support for 0.103 by one year, citing the build system changes in 0.104 and the Rust requirement introduced in 0.105. Cisco does not offer paid technical support or paid extended support for ClamAV.

Features

ClamAV includes a command-line scanner, automatic database updater, and a scalable multi-threaded daemon running on an anti-virus engine from a shared library. These are the clamscan scanner, the FreshClam updater, the clamd daemon with its clamdscan client, and the libclamav library. The project also maintains clamav-milter, a Milter interface for the Sendmail mail transfer agent. It recognizes:

Detection relies on digitally signed signature databases distributed by the ClamAV team. Signature types include hash-based and content-based signatures, logical signatures that combine several conditions, YARA rules, and bytecode signatures, which run complex detection routines in either a bytecode interpreter or an LLVM-based runtime. By default, ClamAV runs only bytecode signatures signed by Cisco Talos.

The ClamAV virus database is updated at least every four hours and as of 10 February 2017 contained over 5,760,000 virus signatures with the daily update Virus DB number at 23040.

Real-time file scanning

On Linux systems using kernel 3.8 or later, ClamAV offers a real-time protection feature under the name On-Access Scanning. This feature uses the fanotify kernel API to prevent processes from accessing files that ClamAV has identified as malicious. Beginning in version 0.102.0, the on-access scanning functionality was separated from ClamAV's main clamd daemon into the clamonacc application.

The bulk of configuration options for On-Access Scanning are available in clamd.conf, with other options such as log output available in command-line options. Users can run multiple instances of clamonacc simultaneously with different configurations, allowing for customized protection settings for various directories. On-Access Scanning operates in notify-only mode by default which does not prevent access to any files. An optional prevention mode blocks access to a file until it has been scanned.

Clam Sentinel is an open-source third-party companion program for ClamAV on Windows that offers real-time protection functionality. This software was last updated in July 2014.

Integration and deployment

Many mail systems can pass messages to ClamAV for scanning. Exim has supported ClamAV natively since release 4.50, and third-party interfaces such as amavisd-new, MIMEDefang and ClamSMTP connect it to Sendmail, Postfix and other mail transfer agents. Other community projects use ClamAV to scan files uploaded to web applications or stored in cloud storage, and ClamFS provides on-access scanning through a FUSE file system. The project also publishes official Docker images.

ClamAV is also embedded in commercial products. Synology's free Antivirus Essential package for its network-attached storage devices uses the ClamAV scanning engine, and the ClamAV project has described the software as a popular alternative to paid antivirus products on such devices. Cisco's Secure Endpoint connectors for Windows, macOS and Linux incorporate ClamAV, so vulnerabilities in ClamAV can also affect those products.

Effectiveness

At LinuxWorld in 2007, ClamAV was rated among the top three antivirus engines in a live test organized by Untangle that compared it with proprietary products; the test was described at the time as controversial.

In the 2008 AV-TEST comparison of antivirus tools, ClamAV scored poorly in on-demand detection, avoiding false positives, and rootkit detection.

In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28%.

In 2022 Splunk conducted an efficacy study using 416,561 commodity malware samples sourced from MalwareBazaar, grouped as banking trojans, botnets, information stealers, loaders, cryptocurrency miners, remote access tools and generic trojans. ClamAV detected 249,696 of the samples, or 59.94%. It performed well on malicious DOCX, DLL and ELF files and on trojans and botnet malware, but missed many EXE, Excel and ZIP files and performed poorly on cryptocurrency miners, remote access tools and information stealers. Splunk concluded that ClamAV's usefulness depends on the types of files being scanned, citing JAR files as a case where it would miss a large share of malware, and noted that its YARA integration allows organizations to add their own detection rules.

The ClamAV engine can be reliably used to detect several kinds of malicious files. In particular, some phishing emails can be detected using antivirus techniques. However, false positive rates are inherently higher than those of traditional malware detection.

Unofficial databases

There are several unofficial databases for ClamAV:

ClamAV Unofficial Signatures are mainly used by system administrators to filter email messages. Detections of these groups should be scored, rather than causing an outright block of the "infected" message. Community tools such as Fangfrisch download third-party databases alongside the official ones; the ClamAV documentation warns users not to enable unsigned bytecode signatures when using signatures from third-party sources.

Platforms

The ClamAV team regularly tests releases on recent versions of Alpine Linux, Ubuntu, Debian, AlmaLinux, Fedora, openSUSE and FreeBSD, as well as macOS and Windows. Other platforms receive less testing, and the project does not support uncommon systems such as HP-UX and Solaris. The documentation notes that ClamAV is likely to stop working on Solaris because the Rust components it now depends on cannot be built directly on that system.

Linux, BSD

ClamAV is available for Linux and BSD-based operating systems. In most cases it is available through the distribution's repositories for installation.

On Linux servers ClamAV can be run in daemon mode, servicing requests to scan files sent from other processes. These can include mail exchange programs, files on Samba shares, or packets of data passing through a proxy server.

On Linux and BSD desktops ClamAV provides on-demand scanning of individual files, directories or the whole PC.

macOS

Mac OS X Server included ClamAV from version 10.4, where it was used by the operating system's email service.[citation needed] A paid-for graphical user interface is available from Canimaan Software Ltd in the form of ClamXav. Additionally, Fink, Homebrew and MacPorts have ported ClamAV. The ClamAV project also publishes a macOS installer package built as a universal binary for Intel and Apple silicon processors.

Another program which uses the ClamAV engine on macOS is Counteragent. Working alongside the Eudora Internet Mail Server program, Counteragent scans emails for viruses using ClamAV and also optionally provides spam filtering through SpamAssassin.

OpenVMS

ClamAV for OpenVMS is available for DEC Alpha and Itanium platforms. The build process is simple and provides basic functionality, including library, the clamscan utility, the clamd daemon, and freshclam for update.

Windows

As of version 0.97.5, ClamAV builds and runs on Microsoft Windows.[citation needed] There are IA-32 and x64 variants of ClamAV available for Windows. The ClamAV team publishes official Windows builds as an installer or a portable ZIP package and tests releases on Windows 10 and 11. Cisco's Immunet used ClamAV as its engine until Cisco discontinued the product on 1 January 2024.

OS/2

A port of ClamAV is available for OS/2 (including eComStation and ArcaOS) with a native UI written in REXX.

Graphical interfaces

Since ClamAV does not include a graphical user interface (GUI) but instead is run from the command line, a number of third-party developers have written GUIs for the application for various platforms and uses.

These include:

ClamTk 6.18 running on openSUSE

See also

References

  1. ↑ "Release 1.5.4". 7 August 2026. Retrieved 8 August 2026.
  2. ↑ "ClamAV 1.5.0-beta". 1 April 2025. Retrieved 4 May 2025.
  3. 1 2 3 4 5 6 7 8 9 10 "ClamAV". ClamAV Documentation. Cisco Systems. Retrieved 3 November 2026.
  4. 1 2 3 4 5 6 7 8 9 10 "ClamAV Documentation" (single-page edition). Cisco Systems. Retrieved 3 November 2026.
  5. 1 2 3 4 ClamAV (2007). "About ClamAV". Retrieved 25 December 2008.
  6. ↑ ClamAV (2007). "ClamAV Packages and Ports". Archived from the original on 20 July 2008. Retrieved 31 December 2008.
  7. 1 2 3 4 5 6 7 "ClamAV EOL Policy". ClamAV Documentation. Cisco Systems. Retrieved 3 November 2026.
  8. 1 2 3 4 5 "Celebrating 20 years of ClamAV". ClamAV blog. Cisco. 9 May 2022. Retrieved 3 November 2026.
  9. ↑ Linux Journal Staff (1 August 2004). "2004 Editors' Choice Awards". Linux Journal. Retrieved 3 November 2026.
  10. 1 2 Prince, Brian (17 August 2007). "Sourcefire Catches ClamAV". eWeek. Retrieved 3 November 2026.
  11. ↑ Mah, Paul (21 August 2007). "Sourcefire acquires ClamAV". TechRepublic. Retrieved 3 November 2026.
  12. ↑ "Open Source ClamAV Continues to Thrive at Sourcefire". InternetNews. Retrieved 3 November 2026.
  13. ↑ "A New Chapter for ClamAV". ClamAV blog. Sourcefire. 19 June 2012. Retrieved 3 November 2026.
  14. ↑ "Introducing the new ClamAV team". ClamAV blog. Sourcefire. 22 June 2012. Retrieved 3 November 2026.
  15. ↑ "Cisco Acquires Cybersecurity Company Sourcefire For $2.7B". TechCrunch. 23 July 2013.
  16. ↑ Lennon, Mike (7 October 2013). "Cisco Completes $2.7 Billion Acquisition of Sourcefire". SecurityWeek. Retrieved 3 November 2026.
  17. ↑ "Trend Micro patent claim provokes FOSS community, leads to boycott". Linux.com. 11 February 2008. Retrieved 12 February 2008.
  18. ↑ "Boycott Trend Micro". Free Software Foundation. 11 February 2008. Retrieved 12 February 2008.
  19. ↑ Paul, Ryan (2 July 2008). "Barracuda bites back at Trend Micro in ClamAV patent lawsuit". Ars Technica. Retrieved 14 February 2012.
  20. ↑ "Ex Parte Reexamination" (PDF). U.S. Patent and Trademark Office. 19 May 2011. Archived from the original on 8 September 2013. Retrieved 4 October 2015.
  21. ↑ "Anatomy of a Dying Patent – The Reexamination of Trend Micro's '600 Patent". Groklaw.net. 13 June 2011. Archived from the original on 27 August 2012. Retrieved 4 October 2015.
  22. 1 2 "Report a Bug". ClamAV Documentation. Cisco Systems. Retrieved 3 November 2026.
  23. 1 2 "End of life (EOL) policy change, 0.103 one year extension, 0.105 past end of life". ClamAV blog. Cisco. 8 May 2023. Retrieved 3 November 2026.
  24. 1 2 3 4 "ClamAV Versions and Functionality Levels". ClamAV Documentation. Cisco Systems. Retrieved 3 November 2026.
  25. ↑ Markovic, Sinisa (6 July 2026). "New ClamAV security patch closes seven scanner bugs dating back two decades". Help Net Security. Retrieved 3 September 2026.
  26. ↑ Staff, S. C. (12 August 2026). "Cisco warns of 7 ClamAV flaws impacting Secure Endpoint Connector". SC Media. Retrieved 3 September 2026.
  27. ↑ Gatlan, Sergiu (11 August 2026). "Cisco warns of high-severity ClamAV flaws with public exploits". BleepingComputer. Retrieved 3 November 2026.
  28. 1 2 Paganini, Pierluigi (11 August 2026). "Cisco Warns of Seven ClamAV Flaws, Two With Public PoCs". Security Affairs. Retrieved 3 November 2026.
  29. ↑ "Changes to ClamAV end-of-life policy and a new Long Term Support policy". ClamAV blog. Cisco. 3 September 2021. Retrieved 3 November 2026.
  30. ↑ "Introduction – ClamAV Documentation". docs.clamav.net. Retrieved 9 March 2024.
  31. ↑ "About ClamAV". Archived from the original on 20 November 2008. Retrieved 25 December 2008.
  32. ↑ "Latest Stable Release". Archived from the original on 18 September 2010. Retrieved 21 August 2010.
  33. ↑ "ClamAV® blog: Configuring On-Access Scanning in ClamAV". 29 March 2016. Retrieved 5 July 2026.
  34. 1 2 "On-Access Scanning - ClamAV Documentation". Retrieved 5 July 2026.
  35. ↑ "ClamAV® blog: Understanding and transitioning to ClamAV's new On-Access scanner". 16 September 2019. Retrieved 5 July 2026.
  36. ↑ "Configuration - ClamAV Documentation". Retrieved 5 July 2026.
  37. 1 2 "Scanning – ClamAV Documentation". docs.clamav.net. Retrieved 2 May 2024.
  38. ↑ "Clam Sentinel download | SourceForge.net". Retrieved 5 July 2026.
  39. ↑ "Clam Sentinel - Browse /clamsentinel/1.22 at SourceForge.net". Retrieved 5 July 2026.
  40. ↑ "AntiVirus Essential: Technical Specifications". Synology Inc. Retrieved 3 November 2026.
  41. ↑ "Anti-virus comparison test of current anti-malware products, Q1/2008". AV-Test GmbH. 22 January 2008. Archived from the original on 15 July 2011. Retrieved 12 February 2008.
  42. ↑ "ShadowServer 180 Day Stats". shadowserver.org. 16 August 2011. Archived from the original on 27 November 2011. Retrieved 16 December 2011.
  43. ↑ Holiday, David (28 November 2022). "How Good is ClamAV at Detecting Commodity Malware?". Splunk. Retrieved 3 November 2026.
  44. ↑ Brad Wardman; Tommy Stallings; Gary Warner; Anthony Skjellum (5 August 2011). "High-Performance Content-Based Phishing Attack Detection" (PDF). uab.edu. Retrieved 19 March 2018.
  45. 1 2 Sanesecurity Phishing, Scam and Malware signatures for ClamAV Archived 10 September 2015 at the Wayback Machine
  46. ↑ SecuriteInfo.com Add 4.000.000 signatures to ClamAV Antivirus
  47. ↑ "ClamAV Unofficial Signatures Updater". sourceforge.net. 24 May 2009. Retrieved 2 September 2014.
  48. 1 2 "About us". ClamXAV. Retrieved 15 July 2017.
  49. ↑ ClamXav.com. "ClamXAV.com". Retrieved 24 January 2009.
  50. ↑ Chupahin, Alexey (December 2008). "Clam AntiVirus OpenVMS Project News". Archived from the original on 6 October 2011. Retrieved 25 December 2008.
  51. ↑ "Alternate Versions of ClamAV". clamav.net. Cisco Systems. Archived from the original on 22 November 2021. Retrieved 26 November 2021. Immunet, powered by ClamAV, is a [...] Windows desktop anti-virus (AV) solution
  52. ↑ "New antivirus solution for personal computers". Purdue University Information Technology. 27 November 2023. Retrieved 3 November 2026.
  53. 1 2 "My graphical user interface for "ClamAV"". Retrieved 3 September 2020.
  54. ↑ "Clamav, ClamAV-GUI (Rexx & QT4) & eCSClamav". Retrieved 3 September 2020.
  55. ↑ Mauroni, Dave (December 2008). "ClamTk Virus Scanner". Retrieved 25 December 2008.
  56. ↑ Mauroni, Dave (October 2008). "ClamTk README". Archived from the original on 14 September 2011. Retrieved 26 December 2008.
  57. ↑ KlamAV F. (May 2006). "KlamAV – Main Page". Retrieved 4 March 2013.
  58. ↑ Saracco, Emmanuel. "wbmclamav – The Webmin ClamAV Antivirus manager". wbmclamav.esaracco.fr.
  59. ↑ ClamXav.com (November 2008). "ClamXav.com". Retrieved 25 December 2008.
  60. 1 2 "CS Anti-Virus description". Softpedia.com. 23 March 2009. Retrieved 9 November 2010.