ClamAV
An open source antivirus engine, used mostly for scanning mail servers and file shares rather than desktops.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
3 more ways to get ClamAV
Other download sites
Run by third parties, not by Cisco Talos. Prefer the official page above when it works.
Package managers
- Chocolatey
choco install clamav - Homebrew
brew install clamav
About ClamAV
ClamAV detects trojans, viruses and other malware using a signature database anyone can read and write to. Its natural home is a server: scanning attachments on a mail gateway, files uploaded to a web application, or a Samba share, usually through the clamd daemon rather than by hand.
On a desktop it is a scanner rather than a protection suite: there is no always-on behavioural monitoring of the kind a commercial product provides. Signature updates come through freshclam, and installers exist for Windows, macOS and Linux as well as Docker images.
Strengths
- Signature format is open, so anyone can write detections
- Designed to be embedded in mail servers, file shares and upload pipelines
- Windows MSI, macOS PKG, Linux packages and Docker images
- Backed by Cisco Talos, which keeps the signature feed current
Limitations
- Detection rates trail the commercial engines in independent testing
- Not a real-time desktop protection suite on its own
- Running it well means understanding clamd and freshclam
- Memory use grows with the signature database
Details
- Pricing
- FreeFree and open source under the GPL 2.0, maintained by Cisco Talos.
- License
- GPL-2.0
- Developer
- Cisco Talos
- Platforms
- Windows, macOS, Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Scanning files on a server before they reach anyone else
- Categories
- Security tools
- Last verified
- Added
- Provenance
- Selected from the TechWalrus downloads catalog (Security); facts checked against the developer's own pages, 2 sources on file.
Alternatives to ClamAV
Compare allSoftware that can replace ClamAV for an important use case, and what changes if you switch.
VirusTotal
Online service that checks a URL or file against many antivirus engines and URL scanners.
VirusTotal is a web service that checks uploaded files against many antivirus engines, so nothing runs locally but samples are processed by a third party.
Hybrid Analysis
Free online sandbox that runs submitted files and URLs and reports on their behaviour.
Hybrid Analysis runs submitted files in an online sandbox and reports behaviour instead of matching signatures, with samples handled by a third-party service.
F-Secure Total
Consumer security suite bundling antivirus, VPN and a password manager.
F-Secure Total is a paid, closed-source consumer suite with real-time desktop and mobile protection plus VPN and password manager, rather than a server scanning engine.
Acronis True Image
Personal backup application from Acronis that combines image-based backup with anti-malware protection.
Acronis True Image is paid, closed-source Windows and macOS software that pairs anti-malware protection with image-based system backup rather than server-side file scanning.
Similar software
Related functionality, not necessarily a direct replacement.
Sandboxie-Plus
Runs a Windows program inside an isolated box, so whatever it writes to disk or the registry disappears afterwards.
simplewall
Puts a plain list of programs in front of the Windows Filtering Platform, so you decide what is allowed online.
Portmaster
Shows every connection each application makes and lets you block any of them, with sensible defaults already set.
YARA
Pattern-matching engine for identifying and classifying malware samples.
YARA-X
Match files against rules describing suspicious binary patterns.
capa
Identify likely capabilities inside executable files.
