ClamAV Explained: The Open-Source Antivirus Engine and What Its Verdicts Mean

ClamAV is the open-source antivirus engine maintained by Cisco Talos, used inside mail gateways, file servers and upload scanners rather than on desktops. It matches files against signature databases (main.cvd, daily.cvd, bytecode.cvd) that freshclam keeps updated, runs as the clamd daemon or the clamscan command, and reports matches by signature name. It is reliable for known threats and structurally limited for new ones.

What ClamAV is, and what it is not

ClamAV began in 2001 as a Unix mail-server scanner and has been maintained by Cisco's Talos group since 2013. At its core is libclamav, a library that identifies file types, unpacks containers and packers, and matches content against signatures. Around it sit a few tools: clamscan for one-off scans, clamd and clamdscan for a resident daemon, freshclam for database updates and sigtool for working with signatures. It is licensed under the GPL, runs on Linux, macOS and Windows, and is the engine behind a large share of the free online scanners and mail filters on the internet, including Scan.now's file scanner, which uses it as one engine alongside its own structural analysis and heuristics when it is available.

It is not a desktop security product. There is no real-time protection by default (on-access scanning exists on Linux through fanotify but is an add-on), no cloud reputation, no behavioural blocking, no sandbox and no exploit protection. Comparing ClamAV with a commercial endpoint suite is a category error; the fair comparison is with the signature layer of one. Understood that way, it is very good at its job.

The signature databases

ClamAV knows nothing without its databases, which are downloaded from Talos and stored in a directory such as /var/lib/clamav:

A .cvd file is a signed, compressed bundle of several signature formats. Inside are hash signatures (.hdb for MD5, .hsb for SHA-1 and SHA-256), body-based hex patterns (.ndb), logical signatures combining several patterns with conditions (.ldb), a YARA subset (.yar), container metadata rules (.cdb), file-type magic (.ftm), phishing URL and email rules (.pdb, .wdb), and allow-lists (.fp, .ign2) for known false positives. sigtool --info daily.cvd prints the version, signature count and build time. sigtool --unpack extracts the raw files if you want to see what a signature looks like:

$ sigtool --info /var/lib/clamav/daily.cvd
File: /var/lib/clamav/daily.cvd
Build time: 14 Sep 2026 08:11 +0000
Version: 27612
Signatures: 2119384
Functionality level: 90
Builder: raynman
Verification OK.

Third-party signature sets exist, and many deployments add them. They can be valuable for phishing and script-based threats and are also the usual source of ClamAV false positives, so add them deliberately rather than by default.

freshclam: the part that must not stop

freshclam downloads database updates from database.clamav.net, which is served through a CDN with rate limits, so it should run as a daemon (checking a configurable number of times per day; the default configuration checks twelve) or from a scheduler, never in a tight loop. Talos has blocked misbehaving clients before. An install whose databases are more than a week old is missing most of what it would catch, and one whose databases are months old will still confidently report "OK" on files it has never heard of. If you run ClamAV anywhere, monitor the database age; the daemon logs a warning when the local version falls behind, and the version numbers in sigtool --info can be compared with the DNS TXT record Talos publishes at current.cvd.clamav.net.

$ freshclam
ClamAV update process started at Mon Sep 14 09:02:11 2026
daily.cld database is up-to-date (version: 27612, sigs: 2119384)
main.cvd database is up-to-date (version: 62, sigs: 6647427)
bytecode.cvd database is up-to-date (version: 335, sigs: 86)

clamscan, clamd and clamdscan

clamscan is the simple tool: it loads every database into memory, scans what you point it at and exits. Loading takes tens of seconds and a good deal of RAM, which is fine for a manual scan and hopeless for a mail server handling thousands of messages. clamd solves that by loading once and staying resident, answering scan requests over a Unix or TCP socket; clamdscan is the thin client that sends a path (or, with --fdpass, the open file descriptor) to the daemon. Web applications and mail filters talk to clamd directly through its socket protocol with commands such as INSTREAM, which streams the file's bytes to the daemon so that nothing needs to touch disk.

# one-off scan with useful options
$ clamscan --recursive --infected --alert-encrypted --alert-exceeds-max \
    --max-filesize=64M --max-scansize=256M ~/Downloads
/home/user/Downloads/invoice.zip: Heuristics.Encrypted.Zip FOUND
/home/user/Downloads/setup.exe: Win.Trojan.Agent-6839221-0 FOUND

----------- SCAN SUMMARY -----------
Infected files: 2

The options matter. Without --alert-encrypted a password-protected archive is silently passed; without --alert-exceeds-max a file larger than the limits is skipped without complaint. The defaults (25 MB per file, 100 MB per scan, recursion 17, 10,000 files) exist to survive decompression bombs, and raising them is reasonable up to the point where a single upload can exhaust the host. --detect-pua enables "potentially unwanted application" signatures for adware, cracks and remote-admin tools, which are off by default because they are judgement calls.

Reading a verdict

A ClamAV detection name follows Platform.Category.Family-SignatureID-Revision. Win.Trojan.Emotet-9812345-0 is a Windows trojan in the Emotet family, matched by signature 9812345, first revision. Doc.Dropper.Agent is a document that drops something; Html.Phishing.Bank is a phishing page; Unix.Malware.Mirai is the Mirai botnet for Linux. Platforms include Win, Osx, Unix, Andr, Doc, Pdf, Html, Js, Txt and Multios. Anything without a family, such as Agent or Generic, is a signature written on a technique rather than a named campaign and is somewhat weaker evidence. Two prefixes mark rules rather than matches:

• Heuristics.*: structural rules such as Heuristics.OLE2.ContainsMacros, Heuristics.PDF.ObfuscatedName, Heuristics.Encrypted.Zip, Heuristics.Broken.Executable and Heuristics.Limits.Exceeded. These describe a property of the file, not a known threat, and most are off unless enabled.
• PUA.*: potentially unwanted applications, reported only with --detect-pua.

The distinction is the same one drawn in signature versus heuristic detection: a family name is a fact, a heuristic name is a question. Scan.now reports a signature match as a known malware signature finding with the signature name, and a heuristic result as the corresponding structural check, such as Office macros or password-protected archive. The harmless EICAR test file is reported as Win.Test.EICAR_HDB-1, which is the quickest way to prove an installation is alive.

What ClamAV is good at

• Known malware in transit. Its databases cover the samples that circulate by email and web download, and the engine's unpacking of zip, RAR, 7z, tar, OLE2, OOXML, PDF, HTML and common PE packers such as UPX means it sees payloads that a naive scanner would miss.
• Phishing and document lures. Signatures for malicious HTML, PDF and Office documents are a large part of daily.cvd, reflecting its mail-gateway heritage.
• Scale and integration. It is free, scriptable, embeddable and predictable, which is why it sits inside so many other products.
• Transparency. You can unpack the database and read the signature that fired. No commercial engine offers that.

Where it falls short

Take ClamAV's limits seriously rather than pretending they are not there. It has no behavioural layer, so a fresh executable packed with a custom crypter usually passes; its emulation is limited to unpacking known packers. It has no reputation layer, so it cannot use the fact that a file is unsigned and has never been seen. Its heuristics are narrow and mostly disabled by default. Independent tests consistently show it detecting well-established malware reliably and new Windows executables poorly. Detection lag on a new campaign can be hours to days, which is where the other layers of a scanner earn their place. Scan.now runs its own structural analysis and heuristics for exactly these gaps: macros, PDF actions, disguised executables, obfuscated scripts and archive tricks are detected by inspection whether or not any signature database has caught up.

Running it yourself

1. Install from your distribution (apt install clamav clamav-daemon, brew install clamav) or from the official packages.
2. Run freshclam once to fetch the three databases, then enable the freshclam service so it keeps running.
3. For occasional use, clamscan -r --infected ~/Downloads. For anything automated, start clamd and use clamdscan or the socket.
4. Create the EICAR file and confirm it is reported before trusting any of it.
5. Set --alert-encrypted and --alert-exceeds-max (or the equivalent AlertEncrypted and AlertExceedsMax in clamd.conf) so that files the engine could not inspect are reported rather than passed.

For how ClamAV compares with the other open-source scanners that tackle websites rather than files, see open-source security scanners compared.