Description:
ClamAV is an open-source antivirus engine widely used on Linux systems for detecting trojans, viruses, malware, and other malicious threats. It consists of multiple components: clamav-daemon (clamd), the main antivirus scanning engine running as a background service; clamav-freshclam, the automatic virus definition database updater; clamav-base, the shared configuration and support files; and clamav, the command-line scanner (clamscan). ClamAV provides on-demand scanning and can be integrated with mail servers, web proxies, and file servers. Real-time (on-access) scanning is available through the separate clamonacc component, which requires additional configuration and is not covered in this guide.
Rationale:
Linux systems are increasingly targeted by malware, ransomware, and cryptominers. While Linux is inherently more secure than some other operating systems, the absence of antivirus software leaves devices vulnerable to malware that can be spread to other systems, stored in files, or delivered through email attachments. ClamAV detects these threats in files so they can be removed before they cause harm or spread across the network.
Impact:
Provides malware and virus scanning on the Linux system.
Automatically updates virus definitions via the freshclam service.
The clamd daemon keeps the virus database loaded in memory, so scans run through it (clamdscan) start quickly.
Detects and alerts on trojans, viruses, malware, and other threats in files.
ClamAV scanning may impact system performance during intensive scans of large filesystems.
Requires periodic internet access to receive updated virus definition databases.
Default Value:
ClamAV is NOT installed by default on Ubuntu or most Linux distributions. It must be manually installed and configured. Once installed, the clamav-daemon and clamav-freshclam services must be explicitly enabled and started. The compliance tool checks for running clamd and freshclam processes on the system.
Pre-Requisite:
Ubuntu 20.04 LTS or later (or equivalent Debian-based Linux distribution).
Administrator (sudo) privileges on the device.
Active internet connection for downloading ClamAV packages and virus definitions.
Sufficient disk space for the ClamAV virus definition database (approximately 300 MB) and at least 2 GB of RAM, because clamd keeps the full virus database in memory (roughly 1–1.5 GB).
Remediation:
Test Plan:
Pre-Implementation Check (run before making any changes)
Check whether ClamAV is installed and running:
Expected on a non-compliant device: inactive (on both lines). If both lines show active, ClamAV is already running and no changes are needed.
Post-Implementation Check (run after completing the Implementation Steps)
Test 1: Verify ClamAV services are running
Confirm both services are active and running:
Expected: Active: active (running) — Main PID: [number] (clamd)
Expected: Active: active (running) — Main PID: [number] (freshclam)
Also verify processes are running:
Expected: each command prints one line with a process number (PID) and the program path. No output means that process is not running.
Test 2: Test that ClamAV detects threats
Create the EICAR test file — a harmless, industry-standard text string that every antivirus product detects as a test virus — and scan it with the ClamAV daemon:
Expected output: a line ending in FOUND (for example: /tmp/eicar.txt: Win.Test.EICAR_HDB-1 FOUND). This confirms ClamAV is detecting threats.
Delete the test file:
Optional — scan all home folders on demand:
Expected output: Infected files: 0 (any detected threats will be listed by file name).
Implementation Steps:
Step 1: Update package lists
Open a Terminal and update the package manager:
Step 2: Install all ClamAV packages
Install ClamAV and all required components:
This installs: clamav (command-line scanner), clamav-base (shared configuration and support files), clamav-daemon (scanning engine), clamav-freshclam (definition updater).
Step 3: Stop services temporarily to update virus definitions
Stop the services before running the initial database update:
Step 4: Update the virus definition database
Download the latest virus definitions:
Wait for the download to complete. This may take a few minutes depending on internet speed.
Step 5: Enable and start ClamAV services
Enable services to start on boot and start them immediately:
Note: clamd needs 1–2 minutes to load the virus database after it starts. If Test 1 in the Post-Implementation Check shows “activating” instead of “active (running)”, wait a minute and check again.
Backout Plan:
Step 1: Stop and disable ClamAV services
Run the following commands to stop and disable ClamAV:
Step 2: Uninstall ClamAV packages (optional)
To fully remove ClamAV from the system:
Note: Removing ClamAV leaves the system without antivirus protection. Reinstall an approved antivirus solution as soon as possible.
Note:
Keep the ClamAV virus definition database up to date — freshclam handles this automatically when running. Ensure the device has periodic internet access so freshclam can download the latest definitions. This setup provides on-demand scanning; real-time (on-access) scanning requires additional configuration of the clamonacc component. For enterprise environments, consider using a commercial EDR solution (CrowdStrike, Sophos, ESET) alongside or instead of ClamAV for advanced threat detection capabilities. ClamAV version can be verified with: clamscan --version