ClamAV: A Beginner’s Guide of Commands and Usage

Last updated on November 18th, 2025 at 11:15 am

I understand – you installed Linux and remembered that you need some antivirus for your new Linux OS. The vast majority of people think Linux is bulletproof, but here’s the deal: It really isn’t. I did this mistake the hard way while hosting few files from my server. And that’s when I discovered ClamAV, and you know what? It’s a lot easier than I thought.

Let me hold your hand the whole way through, buddy, and show you precisely how to use ClamAV.

What Is ClamAV Anyway?

Before we get started, here’s the scoop: ClamAV is a free and open source antivirus that works really well on Linux. It has been around for years, and tons of people trust it. I found it while looking around for something that I wouldn’t have to pay a monthly subscription fee for, and as these things go it’s not terrible.

The best part? It’s a command-line thing, which sounds scary but is actually dead simple once you try it.

Getting ClamAV Installed

Here’s how I got it to work on my Ubuntu system. If you have a different version of Linux, the steps are nearly the same.

First, open your terminal. Yeah, yeah terminal is a techie term, but just trust me on this.

Type these commands line by line:

sudo apt update

sudo apt install clamav clamav-daemon

That’s it. Seriously. It is downloading everything you need, the scanner module, the signatures database updater and the daemon for real-time protection.

I recall waiting about 2 minutes for this to complete. Get yourself a cup of coffee and let it work its magic.

Updating the Virus Database

One thing I wish someone would have told me didn’t need to learn by experience: ClamAV has to download virus definitions before it can scan anything. Consider it like updating an app on your phone it needs the most current information in order to function properly.

I encountered a slight hitch here. The auto-updater was open in the desktop and intercepting my own update. So I stopped it first:

sudo systemctl stop clamav-freshclam

I also manually updated the database with:

sudo freshclam

It took about 5 minutes on my connection. You will see the signatures downloading – let it complete. When it’s finished, just restart the auto-updater again to keep things current:

sudo systemctl start clamav-freshclam

ClamAV’s own docs, meanwhile, recommend updating at least once a hour if you’re serious about protection. The auto-updater should do this for you automatically when it starts up.

Running Your First Scan

All right, this is where it gets interesting. Let’s actually scan something.

I started small just scanning my Downloads folder to see what would happen. Here’s the command I used:

clamscan -r --infected /home/username/Downloads

Replace “username” with your username. The -r flag is telling it to list through the folders (recursive) and –infected means that you want it only to show you the bad stuff, not every file it checks.

My first scan found… nothing. Which was weirdly disappointing? I hoped to see it catch something. But hey, I have a clean system right.

If you want to go through all the files in your home directory:

clamscan -r --infected ~

Fair warning: this is a bit of a process. I’m like 20-30 minutes once stuff is in there or something.

Do you want ClamAV to Actually Remove the Threats it Finds?

Here’s what I discovered on my first scan: ClamAV will identify threats, but it won’t delete anything for you automatically. You have to tell it to.

Add the –remove flag:

clamscan -r --infected --remove /path/to/folder

I tried this on a Folder containing a Test virus File (yeah I downloaded one for the purpose of testing) and glommed onto it right away and removed it.. Pretty satisfying, honestly.

Configuring the Daemon to Work in Real-Time Mode

This part is optional, but I would highly recommend it. The daemon works in the background and checks files when you open them. It is as if there is always a watch dog that doesn’t sleep.

Start it with:

sudo systemctl enable --now clamav-daemon

That command does two things: It allows it to start automatically any time you boot, and starts it up right now.

I checked if it was running:

sudo systemctl status clamav-daemon

You should see “active (running)” in green. If you do, you’re golden.

Fast Tips I Wish I Knew Sooner

RAM is a concern: ClamAV requires at least 3GB of RAM to perform effectively, as detailed here. My aging laptop had a little trouble with it but my more robust machine handled it fine.

False positives do occur: especially I’ve had ClamAV decide to alert on a file once. It is not common, but if you are confident that a service would be safe to allow through, especially by whitelisting services within config files.

GUI users can try ClamTk: If that command-line feel isn’t doing it for you, there’s also a graphical package installable. It’s a GUI, so it’s point-and-click easy:

sudo apt install clamtk

I started it for the first few days and then gradually became familiar with the commands. No shame in that.

My Final Take

ClamAV learning curve was like, an hour total including downloading the database. It’s not fancy, it doesn’t shoot flashy notifications at you but it gets the job done. And for a free tool? That’s pretty impressive.

If you are new to Linux security then this is a good starting point. Install it, make sure it updates automatically and do a regular scan. You don’t have to be a techie to stay safe online.

And while security isn’t the most fun thing on your plate, it’s reassuring to know you’re running open-source security relied upon by thousands of people. Try it out worst case, you pick up a few new terminal commands.

Read:

When is 547x-lp83fill Going to Be Live? The Wait’s Almost Over