ClamAV is arguably the most popular anti-virus package for GNU/Linux systems.
Installing ClamAV
Super simple, set use flags and emerge.
The clamdtop flag is recommended because, to quote euse -i clamdtop "A Top like tool which shows what clamd is currently scanning amongst other things".
root@host # grep clamav /etc/portage/package.use app-antivirus/clamav bzip2 clamdtop iconv ipv6
root@host # emerge -pv clamav [ebuild N ] app-antivirus/clamav-0.95.3 USE="bzip2 clamdtop iconv ipv6 -milter (-selinux)" 26,289 kB
Configure ClamAV
First update the virus database using freshclam, then ClamAV can run as a daemon for processing.
Other applications (maybe CVS) can use clamscan to process individual files.
Updating Virus Database
Use the tool freshclam, which you may want to configure in /etc/freshclam.conf.
The DatabaseMirror should be set to db.[ISO2 Country Code].clamav.net, database.clamav.net is a fallback.
root@host # cat /etc/freshclam.conf AllowSupplementaryGroups yes DatabaseMirror db.us.clamav.net DatabaseMirror database.clamav.net DatabaseOwner clamav LogFacility LOG_LOCAL1 LogSyslog yes NotifyClamd /etc/clamd.conf PidFile /var/run/clamav/freshclam.pid ScriptedUpdates yes UpdateLogFile /var/log/clamav/freshclam.log
Ubuntu systems configs are in /etc/clamav, other paths should be adjusted as well.
root@host freshclam -v --debug Current working dir is /var/lib/clamav Max retries == 3 ClamAV update process started at Wed Feb 24 13:16:29 2010 Using IPv6 aware code Querying current.cvd.clamav.net TTL: 855 Software version from DNS: 0.95.3 main.cvd version from DNS: 52 LibClamAV debug: in cli_untgz() LibClamAV debug: cli_untgz: Unpacking ./clamav-c4d3b527d0a1f3f962452ec7825f96a1/COPYING LibClamAV debug: cli_untgz: Unpacking ./clamav-c4d3b527d0a1f3f962452ec7825f96a1/main.info LibClamAV debug: cli_untgz: Unpacking ./clamav-c4d3b527d0a1f3f962452ec7825f96a1/main.db LibClamAV debug: cli_untgz: Unpacking ./clamav-c4d3b527d0a1f3f962452ec7825f96a1/main.hdb LibClamAV debug: cli_untgz: Unpacking ./clamav-c4d3b527d0a1f3f962452ec7825f96a1/main.mdb LibClamAV debug: cli_untgz: Unpacking ./clamav-c4d3b527d0a1f3f962452ec7825f96a1/main.ndb LibClamAV debug: cli_untgz: Unpacking ./clamav-c4d3b527d0a1f3f962452ec7825f96a1/main.zmd LibClamAV debug: cli_untgz: Unpacking ./clamav-c4d3b527d0a1f3f962452ec7825f96a1/main.fp Retrieving http://database.clamav.net/main-52.cdiff Trying to download http://database.clamav.net/main-52.cdiff (IP: 168.143.19.95) Downloading main-52.cdiff [100%] cdiff_apply: Parsed 159797 lines and executed 159797 commands main.cld updated (version: 52, sigs: 704727, f-level: 44, builder: sven) daily.cvd version from DNS: 10450 LibClamAV debug: in cli_untgz() LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/COPYING LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.cfg LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.ign LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.ftm LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.info LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.db LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.hdb LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.hdu LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.mdb LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.mdu LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.ndb LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.ndu LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.ldb LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.zmd LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.fp LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.pdb LibClamAV debug: cli_untgz: Unpacking ./clamav-9ff7ebcd179699ae017b7626ea19ba97/daily.wdb Retrieving http://database.clamav.net/daily-9956.cdiff Trying to download http://database.clamav.net/daily-9956.cdiff (IP: 168.143.19.95) WARNING: getfile: daily-9956.cdiff not found on remote server (IP: 168.143.19.95) WARNING: getpatch: Can't download daily-9956.cdiff from database.clamav.net Retrieving http://database.clamav.net/daily-9956.cdiff Trying to download http://database.clamav.net/daily-9956.cdiff (IP: 64.246.134.219) WARNING: getfile: daily-9956.cdiff not found on remote server (IP: 64.246.134.219) WARNING: getpatch: Can't download daily-9956.cdiff from database.clamav.net Retrieving http://database.clamav.net/daily-9956.cdiff Ignoring mirror 168.143.19.95 (due to previous errors) Trying host database.clamav.net (194.8.197.22)... Trying to download http://database.clamav.net/daily-9956.cdiff (IP: 194.8.197.22) WARNING: getfile: daily-9956.cdiff not found on remote server (IP: 194.8.197.22) WARNING: getpatch: Can't download daily-9956.cdiff from database.clamav.net WARNING: Incremental update failed, trying to download daily.cvd Whitelisting short-term blacklisted mirrors Retrieving http://database.clamav.net/daily.cvd Trying host database.clamav.net (208.72.56.53)... Trying to download http://database.clamav.net/daily.cvd (IP: 208.72.56.53) Downloading daily.cvd [100%] LibClamAV debug: MD5(.tar.gz) = 1f57d428fa6448f3a2d8beb8aea1ec6a LibClamAV debug: cli_versig: Decoded signature: 1f57d428fa6448f3a2d8beb8aea1ec6a LibClamAV debug: cli_versig: Digital signature is correct. daily.cvd updated (version: 10450, sigs: 16484, f-level: 44, builder: ccordes) Database updated (721211 signatures) from database.clamav.net (IP: 208.72.56.53)
ClamAV Daemon
This runs resident scanner, that is faster for other applications to hook into as the virus database is always loaded.
In place of scanning with clamscan use clamdscan.
Also notice START_FRESHCLAM=yes which will have freshclam running according to it's configuration.
Configure this in /etc/conf.d/clamd and start the clamd init script.
root@host # cat /etc/conf.d/clamd START_CLAMD=yes START_FRESHCLAM=yes CLAMD_NICELEVEL=3 FRESHCLAM_NICELEVEL=19
root@host # rc-update -a clamd root@host # /etc/init.d/clamd start