ClamAV

ClamAV is an open-source antivirus engine and toolkit designed primarily for mail gateway and on-demand file scanning. It provides a shared engine library, a multi-threaded scanning daemon, command-line utilities, and automated signature updates for detecting trojans, viruses, and other malware.

Key Features

• Multi-threaded scanning daemon (clamd) and command-line scanners (clamscan/clamdscan) for on-demand and gateway scanning.
• Automatic signature updates and signed signature databases for trusted definitions.
• Bytecode signature runtime (LLVM or custom interpreter) for complex detection routines.
• Broad file-format and archive unpacking support (ZIP, RAR, 7Zip, ISO, DMG, OLE2/OOXML, many others).
• Flexible deployment: daemon for servers, CLI tools for ad-hoc scanning, and Docker images for containerized use.

Use Cases

• Mail gateway scanning: integrate clamd with MTA stacks to scan incoming/outgoing mail for malware.
• On-demand file and archive scanning: scheduled or manual scans of file shares, uploads, or CI/CD artifacts.
• Embedded or containerized scanning: run ClamAV in containers or include libclamav in tooling to provide detection capabilities.

Limitations and Considerations

• Large file/archive size: ClamAV historically has limitations scanning archives larger than ~2 GiB; community tools exist to work around that limitation. Users scanning very large archives should verify current limits and consider supplemental tooling.

ClamAV is maintained by the Cisco Talos team and is licensed under GPLv2. The project source, build system (CMake), and supplemental Rust components are available in the public repository. The official site lists the latest stable release and downloads, while full documentation and platform support details are published in the project manual.