MoonPoint Support Logo


Shop Amazon Warehouse Deals - Deep Discounts on Open-box and Used ProductsAmazon Warehouse Deals

Advanced Search
Sun Mon Tue Wed Thu Fri Sat

Mon, Sep 20, 2004 1:13 am

Clam Antivirus (ClamAV)

A free antivirus package for Linux systems, Clam Antivirus, is available from

I downloaded the Clam AntiVirus package with wget . I then installed the package on a mail server running Fedora Core 2 Linux.

rpm --install clamav-0.75.1-1.i386.rpm
warning: clamav-0.75.1-1.i386.rpm: V3 DSA signature: NOKEY, key ID 6cdf2cc1

The warning message can be prevented by using the command rpm --import prior to installing the package.

To use up2date to update the package, add the lines below to /etc/sysconfig/rhn/sources if you are using Fedora Core 1. You can add them after the other yum lines:

yum crash-hat
#yum crash-test

If you are using Fedora Core 2, use the lines below:

yum crash-hat
#yum crash-test

Otherwise, you will get the error message below when you try up2date clamav:

The following packages you requested were not found:

Once you have added the line to /etc/sysconfig/rhn/sources, you can then use up2date -u clamav to update the software to a later version when one becomes available.

If you are using another version of Linux, see for information. Clam AntiVirus will run on other operating systems as well. Supported platforms are listed below (tested platforms in parentheses):

Some features may not be available on all operating systems.

If you install the package with the rpm or up2date commands, a new group and a new user account will be created, both named clamav. The clamav configuration file will be located in /etc/clamav.conf. The virus database updater program is called "freshclam". Freshclam's configuration file is /etc/freshclam.conf. You can control how often freshclam checks for new virus signatures by adjusting the Checks value in the /etc/freshclam.conf file. The log file for clamav is /var/log/clamav/clamd.log and the log file for freshclam is in /var/log/clamav/freshclam.log.

The program doesn't start automatically when you install it with the rpm or up2date commands. You can start it with /etc/init.d/clamd start or by rebooting the system.

If you left the TCP listening port to be the default of 3310, you can see whether it is running by using the netstat command netstat -at | grep 3310. You should see the system is listening for connections on that port.

tcp        0      0 *:3310                  *:*                     LISTEN

Or you can use the ps command to check on whether it is running:

[root@mail root]# ps aux | grep clamd | grep -v "grep"
clamav    2315  0.0  6.1 18024 15628 ?       S    00:13   0:00 /usr/sbin/clamd

You can use the clamscan command to scan a directory or file for viruses. E.g. a scan of the files in the directory where clamav test files are stored might produce output such as that shown below:

[root@mail root]# clamscan /usr/share/doc/clamav-0.75.1/test
/usr/share/doc/clamav-0.75.1/test/test-failure.rar: RAR module failure
/usr/share/doc/clamav-0.75.1/test/test-failure.rar: OK
/usr/share/doc/clamav-0.75.1/test/README: OK
/usr/share/doc/clamav-0.75.1/test/test.bz2: ClamAV-Test-Signature FOUND
/usr/share/doc/clamav-0.75.1/test/ ClamAV-Test-Signature FOUND
/usr/share/doc/clamav-0.75.1/test/test-zip-noext: ClamAV-Test-Signature FOUND
/usr/share/doc/clamav-0.75.1/test/test.msc: ClamAV-Test-Signature FOUND
/usr/share/doc/clamav-0.75.1/test/test.rar: ClamAV-Test-Signature FOUND
/usr/share/doc/clamav-0.75.1/test/test: ClamAV-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 24009
Scanned directories: 1
Scanned files: 8
Infected files: 6
Data scanned: 0.00 MB
I/O buffer size: 131072 bytes
Time: 5.640 sec (0 m 5 s)

The files in the clamav test directory are actually harmless, but the scan shows you the clamav scanning program is working. If you want to test with an actual worm, you can use the following example of Worm.SomeFool.P, aka W32.Netsky.P@mm.


If you want to scan just a particular file, you can use put the file name after the command, e.g. clamscan corrected_doc.pif.

If you wish to manually update the virus defintions, issue the command freshclam.

Clam AntiVirus 0.75.1-1 Package and Download Information

Milter package for use with sendmail
Clam AntiVirus 0.75.1-1 Milter Package and Download Information

[/security/antivirus/clamav] permanent link

Once You Know, You Newegg AliExpress by

Shop Amazon Local - Subscribe to Deals in Your Neighborhood

Valid HTML 4.01 Transitional

Privacy Policy   Contact

Blosxom logo