What Is ClamAV? The Complete Guide for 2026

You've probably seen ClamAV recommended a dozen times. Someone on a Linux forum asks which antivirus to install, and three replies say the same word. A hosting provider mentions it in passing. A guide tells you to run clamscan and move on.

But nobody really explains what it is. Is it a full antivirus? A scanner? Something only servers use? And can you trust it with your files?

So here's the plain version. What ClamAV is, how it works, what changed in the last year, and whether it belongs on your machine. No sales pitch for ClamAV, and none for us either. You'll know enough by the end to decide yourself.

What is ClamAV, in one paragraph

ClamAV is a free, open-source antivirus engine. It scans files on your own machine and compares them against a database of known threats: trojans, viruses, malicious documents, phishing attachments and more. It's licensed under the GPLv2, the full source is public, and Cisco's Talos threat research group maintains it. It runs on Linux, macOS, Windows and the BSDs, and it was originally built to scan email on mail gateways, which is still one of its biggest jobs. The official documentation describes it as an antivirus toolkit, and that word matters. It gives you the engine and the tools. It doesn't give you an app.

Where ClamAV came from

Tomasz Kojm released the first version, 0.10, on May 8, 2002. According to the ClamAV team's own 20th-anniversary post, the goal was simple: help people filter malware and spam out of their inboxes, for free.

It spread fast through universities, ISPs and anyone running a Unix mail server. Sourcefire acquired the project in 2007 and hired core developers to work on it full-time. Then Cisco bought Sourcefire in 2013, and ClamAV moved under what is now Cisco Talos.

That backing is the reason ClamAV still exists. Building a detection engine is a one-time effort. Keeping its signatures current is a daily one, and it needs analysts, sample pipelines and someone to handle false positives. Volunteer projects rarely manage that for long. ClamAV did it with corporate funding while staying open source.

How ClamAV actually works

When you scan a file, ClamAV does roughly four things:

1. Unpacks it. ZIP, RAR, 7z, tar, CAB, PDF, Office documents, email messages, disk images. ClamAV opens the container and scans what's inside, because malware rarely arrives naked.
2. Matches signatures. It checks content against several signature types: file hashes for exact known-bad files, byte patterns that identify a malware family, and logical signatures that combine conditions. It can also load a supported subset of YARA rules.
3. Runs bytecode and heuristics. Bytecode signatures are small programs that handle trickier cases, like unpacking a specific packer. Heuristic checks flag things like broken executables or phishing-style links.
4. Reports the name. A hit comes back with a detection name, such as Win.Trojan.Agent-123456, so you can look up exactly what was found.

All of this happens locally. ClamAV doesn't upload your files or their hashes anywhere to get a verdict. The only regular network traffic is freshclam, the updater, downloading new signatures. Same file plus same database gives the same answer every time, and you can see why.

The signature database changed in 2026

If you read an older guide, it'll quote a big number, usually "over 5 million signatures." That number is out of date, on purpose.

In late 2025, Cisco Talos announced it would retire signatures that no longer matched anything in current threat data. The first pass started on December 16, 2025. Talos expected main.cvd to drop from about 163 MB to roughly 80 MB, and daily.cvd from 62 MB to roughly 22 MB. They also said RAM use could fall by as much as a quarter.

Fewer signatures sounds like less protection. It mostly isn't. Those entries were matching malware nobody was seeing anymore, and Talos says it will bring back any retired signature if old threats return. For you, it means smaller downloads and a lighter clamd.

Want the real number on your own machine? Run a scan and look at the summary. The Known viruses: line tells you how many signatures your installed database holds today.

Two other changes worth knowing about:

• Old versions stop getting signatures. ClamAV 0.103 stopped receiving database updates on September 14, 2025. If you're on an old distro release that still ships 0.103, your scanner is quietly checking against a frozen list. Run clamscan --version to check.
• Signed databases. ClamAV 1.5, released in October 2025, added a FIPS-compatible way to verify signature downloads using .cvd.sign files. Mostly invisible to you, but it's one more check that the database you got is the one Talos published.

Where ClamAV runs today

Most people who benefit from ClamAV never see it.

• Mail servers. This is what it was built for. Postfix, Exim and Sendmail setups commonly pass attachments through ClamAV before delivery, often via content filters like Amavis.
• File sharing and uploads. Self-hosted cloud storage like Nextcloud offers ClamAV-based scanning for uploaded files, and plenty of web apps run uploads through clamd before saving them.
• Public sector. CISA, the U.S. cybersecurity agency, lists ClamAV in its catalog of no-cost security tools. That's a listing in a resource catalog, not a formal endorsement, but it tells you who relies on it.
• Linux desktops. Most consumer antivirus brands don't ship a Linux desktop product at all (we checked each vendor's own documentation), so ClamAV is often the only maintained engine people can install.

What it's good at, and where it stops

Where ClamAV does well:

• Known threats. Catalogued malware, malicious documents and booby-trapped archives are its home ground.
• Windows malware passing through Linux. Your Linux laptop isn't the target for most of it, but the USB stick you lend a friend, the shared folder and the old documents you migrated might be carrying it.
• Privacy. No account, no telemetry and no cloud verdicts, and the code is public. You can check every one of those claims yourself.

Where it stops:

• No behavioral layer. ClamAV looks at files, not at what running programs do. A brand-new threat with no signature yet can get past it.
• Real-time scanning is Linux-only, and manual. The on-access scanner uses the Linux kernel's fanotify interface and needs clamd and clamonacc configured by hand. On macOS and Windows, ClamAV is an on-demand scanner.
• PUA detection is off by default. Adware and other "potentially unwanted" apps are only flagged if you add --detect-pua=yes.
• No real interface. It's a terminal tool. ClamTk, the long-standing Linux GUI, shipped its last release (6.18) in January 2024.
• Little independent lab data. Big testing labs don't test raw ClamAV. ClamXAV, a Mac app built on the ClamAV engine, has earned AV-TEST macOS certification, but ClamXAV also ships its own extra detection rules. So be careful with anyone who quotes a precise ClamAV detection rate.

We go deeper on the trade-offs in Is ClamAV good enough in 2026? and compare it head-to-head with paid products in ClamAV vs Bitdefender and paid antivirus.

Why updating the engine matters too

Here's something most guides skip. Fresh signatures only help if the engine reading them is up to date as well.

A scanner's whole job is opening hostile files, which makes its parsers a target. In August 2026, ClamAV shipped 1.5.4 and 1.4.6, fixing a batch of parser bugs in ZIP, PDF, Mach-O, XAR and GPT handling. Some of them had been in the code for years.

That's not a reason to distrust ClamAV. Every scanner has bugs like these. With ClamAV you get to see each one found, fixed and documented with a CVE. But it does mean freshclam isn't enough on its own. Let your package manager update ClamAV too.

Getting started

# Debian / Ubuntu / Mint
sudo apt install clamav clamav-daemon

# Fedora
sudo dnf install clamav clamd clamav-update

# Arch
sudo pacman -S clamav

# macOS (Homebrew)
brew install clamav

On Windows, use the installer from the official ClamAV downloads page.

Then update the signatures and run a first scan:

sudo freshclam
clamscan -r -i ~/Downloads     # -i lists only infected files

On Linux, our step-by-step malware scanning walkthrough covers the rest: the EICAR test, reading results without panicking, and scheduling scans so you don't have to remember.

Where XorShield stands

We should be upfront here. XorShield AV isn't built on ClamAV, and it isn't open source. It runs its own on-device engine: known-threat signatures, YARA pattern matching, on-device AI for fresh threats, and behavioral monitoring. ClamAV deliberately leaves out that last layer.

What we share with ClamAV is the part that matters most: your files stay on your device. Out of the box, XorShield's only network connection is downloading signature updates. Threat-intelligence lookups are opt-in, and you can confirm all of it with a network monitor in a few minutes.

If you're happy in a terminal, ClamAV is a real answer, and we'd rather tell you that than pretend otherwise. If you want real-time protection, quarantine and a clean app on Linux, macOS and Windows without configuring a daemon, that's what we're building.

Your device. Your rules.

Last updated: September 2026