ClamAV review

ClamAV is the default answer for Linux malware scanning because it is free, open source and documented in depth. It ships clamscan for quick one-off scans, clamd for faster repeated scans through a daemon, and freshclam to keep signatures current. The feature that matters most for desktop users is clamonacc, the on-access scanner. It uses the Linux fanotify API to block a process from opening a malicious file at the kernel level, so an infected download is stopped when it is read, not only at the next scheduled scan. The engine understands archives, ELF and Windows executables, Office files and PDFs, which helps if you share files with Windows users. The cost is effort. On-access mode needs clamd and clamonacc running side by side and a few clamd.conf edits, and the project recommends at least 3 GiB of RAM for the standard database. There is no official graphical app, so plan on the terminal.

Who it is for

Ubuntu and Linux Mint users who want free on-demand and on-access malware scanning and are comfortable with config files.

Price

Free and open source under GPLv2.

ClamAV is an open source (GPLv2) anti-virus toolkit, designed especially for e-mail scanning on mail gateways.
Quoted from the vendor pricing page on November 10, 2026.

Key features

• clamscan for one-time scans and clamd, a multi-threaded scanning daemon
• On-access scanning with clamonacc, which uses the kernel fanotify API to block access to malicious files
• freshclam updater for the official signature database, updated multiple times per day
• Built-in support for ZIP, RAR, Tar, GZIP and other archives, plus ELF and Portable Executable files
• Scans Office documents, HTML, RTF and PDF files

Strengths and weaknesses

• Strength: Free with no device limits or subscription
• Strength: Kernel-level on-access blocking on Linux, not just scheduled scans
• Strength: Ubuntu 24.04 and 22.04 are on the project's regularly tested list
• Weakness: Setup for on-access scanning means editing clamd.conf and running two services
• Weakness: No official desktop window; the project ships command-line tools
• Weakness: The docs recommend at least 3 GiB of RAM for the standard signature database

Key facts

• License: GPLv2
• On-access requirement: Linux kernel 3.8 or newer
• Tested Linux releases include: Ubuntu 24.04, Ubuntu 22.04, Debian 13, Debian 12
• Recommended RAM: 3 GiB or more

Where it ranks

ClamAV is No. 1 in our Best Antivirus for Linux verdict.