How to Install ClamAV on Ubuntu

Deepak Prasad
Tested on Ubuntu 26.04 LTS (Resolute Raccoon)
Package clamav 1.5.4+dfsg-0ubuntu0.26.04.1
clamav-daemon, clamav-freshclam, clamdscan at the same 1.5.4 build
Applies to Ubuntu 26.04 LTS, 24.04 LTS, and 22.04 LTS
Privilege sudo for package install and service control
Scope Install ClamAV from Ubuntu main with apt, keep signature databases updated through the packaged FreshClam workflow, test with EICAR, run on-demand scans with clamscan and clamdscan, and remove the packages safely. Does not cover ClamTK, on-access scanning with clamonacc, mail filtering, or third-party ClamAV builds.
Related guides Does Ubuntu need antivirus?
Install chkrootkit on Ubuntu
Install ClamAV on CentOS 7
Short on time?Beta Get the gist of this 12-minute read in seconds, then ask follow-up questions

Ubuntu ships ClamAV in the main repository, so you install the scanner, signature updater, and optional scanning daemon with apt. Malware signatures are detection rules FreshClam downloads so the scanner can recognize known malicious files and patterns. Use clamscan for occasional file checks. Use clamd—a long-running background service (daemon) that keeps that database in memory—with clamdscan when you scan often.

This walkthrough was captured on Ubuntu 26.04 LTS with ClamAV 1.5.4. The same packages and commands apply to 24.04 and 22.04 LTS (also verified on 24.04 with an identical apt workflow). For whether desktop antivirus is worth the overhead, see does Ubuntu need antivirus?.

Quick Answer

Install the standalone scanner, daemon, and daemon client:

bash
sudo apt update

This guide installs the standalone scanner and optional daemon so you can compare clamscan and clamdscan. For occasional manual scans only, sudo apt install clamav is enough—Ubuntu pulls in clamav-freshclam for signature updates. To follow the full walkthrough, install the scanner, daemon, and client packages:

bash
sudo apt install -y clamav clamav-daemon clamdscan

Ubuntu pulls in clamav-freshclam so malware signatures can update automatically. Confirm the engine and databases:

bash
clamscan --version

Enable the packaged FreshClam updater if it is not already set to start at boot:

bash
sudo systemctl enable --now clamav-freshclam

Run a quiet test scan after signatures exist:

bash
sudo clamscan -r /tmp

Use clamscan for one-off scans. Use clamdscan after clamav-daemon is running when you need repeated scans without reloading the database each time.

ClamAV Versions on Ubuntu

Canonical backports newer ClamAV builds through security updates, so the version on disk can be newer than the one that shipped on the original release image.

Ubuntu release Current ClamAV package (Ubuntu security update)
26.04 LTS 1.5.4 (tested in this guide)
24.04 LTS 1.5.4
22.04 LTS 1.5.4

Ubuntu 26.04 originally shipped ClamAV 1.4.3 in main; USN-8788-1 (September 2026) pushed 1.5.4 to supported LTS releases. After sudo apt update, install or upgrade picks up that security build.

Ubuntu 22.04 compatibility

22.04 LTS uses the same 1.5.4 security package today. Install commands, paths under /etc/clamav and /var/lib/clamav, and the clamscan versus clamdscan split match 24.04 and 26.04. Check the Ubuntu version when you need the release name for support planning.

What This ClamAV Setup Does

     ┌─────────────┐
     │  FreshClam  │
     └──────┬──────┘
            │ updates
            v
 ┌──────────────────────┐
 │ /var/lib/clamav (DB) │
 └──────────┬───────────┘
      ┌─────┴─────┐
      v           v
┌──────────┐ ┌───────────┐
│ clamscan │ │   clamd   │
│ one-off  │ │  daemon   │
└──────────┘ └─────┬─────┘
                   v
            ┌────────────┐
            │ clamdscan  │
            └────────────┘

On-demand scanning vs on-access protection

This apt install gives you on-demand scanning: nothing runs until you invoke clamscan or clamdscan (or a script you write).

ClamAV also supports Linux on-access scanning through clamonacc and fanotify, but that needs extra configuration, path exclusions, and enough RAM for clamd. That is outside this guide.

Install ClamAV on Ubuntu

Install the scanner, daemon, and daemon client

Ubuntu keeps ClamAV in main (not Universe). The names map like this:

  • clamav → clamscan standalone scanner
  • clamav-daemon → clamd background scanning daemon
  • clamdscan → client that submits scans to clamd
  • clamav-freshclam → freshclam signature updater (Ubuntu’s clamav package depends on clamav-freshclam or clamav-data so signatures are available)

Refresh indexes, then install:

bash
sudo apt update

Pull in the three packages (FreshClam arrives as a dependency):

bash
sudo apt install -y clamav clamav-daemon clamdscan
output
Setting up clamav-base (1.5.4+dfsg-0ubuntu0.26.04.1) ...
Setting up clamav-freshclam (1.5.4+dfsg-0ubuntu0.26.04.1) ...
Setting up clamdscan (1.5.4+dfsg-0ubuntu0.26.04.1) ...
Setting up clamav-daemon (1.5.4+dfsg-0ubuntu0.26.04.1) ...
Created symlink .../clamav-daemon.service → .../clamav-daemon.service.
Setting up clamav (1.5.4+dfsg-0ubuntu0.26.04.1) ...

Packages drop ready-to-use configuration under /etc/clamav. You do not copy .sample files or delete an Example line—that workflow is for upstream source builds, not apt.

Verify the installed version

Confirm the candidate matches the current Ubuntu security build:

bash
apt-cache policy clamav
output
Installed: 1.5.4+dfsg-0ubuntu0.26.04.1
Candidate: 1.5.4+dfsg-0ubuntu0.26.04.1

Print the engine and signature database version clamscan will use:

bash
clamscan --version
output
ClamAV 1.5.4/28157/Sun Oct 18 11:54:14 2026

Before freshclam finishes the first download, the same command may show only the engine version.

Keep ClamAV Malware Signatures Updated

ClamAV needs a usable signature database under /var/lib/clamav before scanning. Ubuntu handles that with FreshClam, usually through the clamav-freshclam service (a long-running freshclam -d process).

NOTE
Ubuntu 26.04 also ships clamav-freshclam-once.timer for a daily one-shot freshclam run. This guide follows the service model—the same default path exercised on 24.04 and on the 26.04 lab host. List units with systemctl list-unit-files | grep -i clam if you prefer the timer workflow. Do not run a second updater on top without disabling the other: both write the same files under /var/lib/clamav and use locking to prevent concurrent updates.

Check the Ubuntu FreshClam updater

Inspect the service with the systemctl command:

bash
systemctl status clamav-freshclam --no-pager
output
● clamav-freshclam.service - ClamAV virus database updater
     Active: active (running)
   Main PID: 193188 (freshclam)
             └─193188 /usr/bin/freshclam -d --foreground=true
Oct 18 12:42:03 ... freshclam[193188]: ... main.cvd updated (version: 63, sigs: 3287027, ...)

active (running) means FreshClam already owns signature updates. If the unit is running but disabled for boot, enable it so updates survive a reboot:

bash
sudo systemctl enable --now clamav-freshclam

Run a one-time FreshClam update

While clamav-freshclam is running, a manual freshclam in another shell fails on the log lock:

bash
freshclam
output
ERROR: Failed to lock the log file /var/log/clamav/freshclam.log: Resource temporarily unavailable

That does not mean ClamAV is broken—it means the service already holds the log. For a one-shot update, stop the service, run freshclam, then start it again:

bash
sudo systemctl stop clamav-freshclam

Run freshclam once in the foreground:

bash
sudo freshclam
output
Mon Oct 18 12:00:02 2026 -> daily.cvd database is up-to-date (version: 28157, ...)
Mon Oct 18 12:00:02 2026 -> main.cvd database is up-to-date (version: 63, ...)

Start the service again so later checks stay automatic:

bash
sudo systemctl start clamav-freshclam

You may see WARNING: Clamd was NOT notified when NotifyClamd cannot reload clamd (Ubuntu often disables the RELOAD command in clamd.conf). That warning does not affect clamscan, which reads /var/lib/clamav directly.

When ClamD needs new signatures immediately

clamd reloads the database on its own through periodic SelfCheck (this Ubuntu package sets SelfCheck 3600 in /etc/clamav/clamd.conf, so roughly hourly). FreshClam documentation notes that when NotifyClamd is not used, clamd still picks up database changes through SelfCheck.

Restart clamav-daemon only when you need newly downloaded signatures loaded now instead of waiting for the next SelfCheck:

bash
sudo systemctl restart clamav-daemon

Test ClamAV with the EICAR Test File

The EICAR test string is not malware. Vendors publish it so scanners can be tested without real malware.

Scan a file with clamscan

The string contains characters the shell would expand. Single quotes write it exactly, with a trailing newline:

bash
printf '%s\n' 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.txt

Add a normal control file:

bash
printf '%s\n' 'hello from a normal text file' > /tmp/clean.txt

Scan both paths:

bash
clamscan /tmp/eicar.txt /tmp/clean.txt
output
/tmp/eicar.txt: Eicar-Signature FOUND
/tmp/clean.txt: OK

----------- SCAN SUMMARY -----------
Engine version: 1.5.4
Scanned files: 2
Infected files: 1
Time: 39.298 sec (0 m 39 s)

Eicar-Signature FOUND proves detection works. OK means no signature matched the clean file. A cold clamscan took about 39 seconds on the 26.04 lab host because it loaded the full database for that run.

Understand ClamAV exit codes

Exit status is separate from the summary text:

  • 0 — scan finished; no matches
  • 1 — at least one signature matched (expected for EICAR)
  • 2 — scan could not complete (often missing databases)

Do not treat exit 1 on EICAR as a broken install.

Scan a Directory Recursively

clamscan without -r does not walk subdirectories. Build a small tree:

bash
mkdir -p /tmp/scan-lab

Copy the EICAR and clean samples into that folder:

bash
cp /tmp/eicar.txt /tmp/clean.txt /tmp/scan-lab/

Walk the directory tree with -r:

bash
clamscan -r /tmp/scan-lab
output
/tmp/scan-lab/eicar.txt: Eicar-Signature FOUND
/tmp/scan-lab/clean.txt: OK
Scanned directories: 1
Scanned files: 2
Infected files: 1
IMPORTANT
Avoid --remove on automated or recursive scans. False positives happen; --remove can delete a legitimate file. Review FOUND lines first. If you automate handling, prefer moving suspicious files into a controlled quarantine directory instead of deleting them.

Delete /tmp/eicar.txt and /tmp/scan-lab when you finish testing so the marker does not skew the next scan.

clamscan vs clamdscan

Tool Role
clamscan Standalone scanner; loads the database for each run
clamd Background daemon; keeps the signature database in memory
clamdscan Sends paths to clamd over the local socket
freshclam Downloads signatures into /var/lib/clamav

Use clamscan for occasional checks on a workstation or small server. Use clamd and clamdscan when you scan frequently and want the database to stay loaded in memory between scans.

Memory considerations for clamd

Loading the signature engine into clamd uses substantially more RAM than a one-off clamscan. On the 26.04 lab host, clamav-daemon settled near 1 GiB resident memory after startup, with a short spike while the database loaded. On a small VPS, stay with clamscan unless you truly need the daemon.

Scan Faster with clamdscan

clamav-daemon will not start until a usable signature database exists under /var/lib/clamav, which is why signature updates come first.

Start the ClamAV daemon

Enable and start the service:

bash
sudo systemctl enable --now clamav-daemon

Confirm it is active:

bash
systemctl status clamav-daemon --no-pager
output
● clamav-daemon.service - Clam AntiVirus userspace daemon
     Active: active (running)
   Main PID: 198510 (clamd)
     Memory: 963.8M (peak: 964.2M)
TriggeredBy: ● clamav-daemon.socket

The package creates /run/clamav and the socket /run/clamav/clamd.ctl.

Scan through the daemon

Give clamd a few seconds to finish loading signatures on first start, then:

bash
clamdscan /tmp/eicar.txt /tmp/clean.txt
output
/tmp/eicar.txt: Eicar-Signature FOUND
/tmp/clean.txt: OK
Time: 0.045 sec (0 m 0 s)

The same two files finished in under a tenth of a second once clamd was warm on the 26.04 lab host. Exit 1 still means a match. If clamdscan runs in the same second the daemon starts, it may block until loading completes.

When clamdscan cannot read your files

clamd runs as the clamav service user. By default, clamdscan may ask the daemon to open the path. If clamd cannot read a file in your home directory—even when your own account can—the scan can fail with a permission error.

Use the local socket and pass open file descriptors to the daemon:

bash
clamdscan --fdpass ~/Downloads

--fdpass lets clamdscan open the files and hand them to clamd instead of requiring the clamav user to open every path.

Update the ClamAV Engine

apt replaces the ClamAV engine; freshclam updates signature files. After security updates, reinstall or upgrade the package:

bash
sudo apt update && sudo apt install --only-upgrade clamav clamav-daemon clamav-freshclam clamdscan

When you are already on the candidate, apt reports no change:

bash
apt-cache policy clamav
output
Installed: 1.5.4+dfsg-0ubuntu0.26.04.1
Candidate: 1.5.4+dfsg-0ubuntu0.26.04.1

Restart clamav-daemon after an engine upgrade if the old clamd process is still running. You do not need to restart clamd after every signature download when SelfCheck or a manual restart already reloaded the database.

Uninstall ClamAV

Remove the packages

Stop the daemon, socket activation, and updater, then purge:

bash
sudo systemctl disable --now \
  clamav-daemon.service \
  clamav-daemon.socket \
  clamav-freshclam.service

Purge the ClamAV packages and their configuration:

bash
sudo apt purge -y clamav clamav-daemon clamav-freshclam clamdscan

Purge removes the packages marked with * in apt output. dpkg may leave /etc/clamav or /var/lib/clamav if they still contain files—that is normal.

Review unused dependencies

Preview what autoremove would delete:

bash
sudo apt-get -s autoremove
output
The following packages will be REMOVED:
  libclamav12 libmspack0t64

Remove only libraries you no longer need:

bash
sudo apt autoremove

Delete /var/lib/clamav manually only when you are sure no ClamAV-compatible service still uses those databases and you do not want to keep them for a reinstall. See how to remove software on Ubuntu for the wider removal workflow.

Troubleshooting

Symptom Likely cause Fix
Failed to lock ... freshclam.log clamav-freshclam already running Leave the service in charge, or stop → freshclam → start
No supported database files found / exit 2 Signature database not downloaded yet sudo systemctl enable --now clamav-freshclam; wait until ls -lh /var/lib/clamav/ shows current database files
WARNING: Clamd was NOT notified RELOAD disabled or clamd not running Safe for clamscan; restart clamav-daemon if clamdscan must see new DBs now
clamdscan cannot connect clamav-daemon inactive Start after databases exist: sudo systemctl start clamav-daemon
clamdscan permission denied clamd user cannot open the path Use clamdscan --fdpass PATH on the local socket, or adjust access deliberately
clamav-daemon stays inactive Unit waits for a usable database Let FreshClam finish; check ls -lh /var/lib/clamav/
clamd uses too much memory Full DB loaded in RAM Use clamscan on small VMs, or stop clamav-daemon when not scanning
Signatures stale after reboot clamav-freshclam not enabled sudo systemctl enable --now clamav-freshclam

Summary

ClamAV on Ubuntu 26.04, 24.04, and 22.04 is a straightforward apt install from main: clamav, clamav-daemon, clamdscan, and clamav-freshclam. Supported LTS releases currently receive 1.5.4 through Ubuntu security updates—even when the original release image shipped an older 1.4.x build.

Let the packaged clamav-freshclam service keep /var/lib/clamav current. Treat a log-lock error from manual freshclam as a sign the service is already working, not as a failed install. Validate detection with the EICAR file, read exit codes 0, 1, and 2 correctly, and avoid --remove on unattended scans.

Use clamscan when memory is tight or scans are rare. Use clamd and clamdscan when repeated scans should stay fast, accepting roughly 1 GiB of RAM for the daemon on a typical signature set. clamd reloads databases through SelfCheck; restart the daemon only when you cannot wait for that cycle after an update.

This guide stops at on-demand scanning. clamonacc on-access protection, ClamTK, and mail filtering are separate topics.

References

Frequently Asked Questions

Does Ubuntu 26.04 include ClamAV?

Yes. Install clamav from the main repository with apt. On a current 26.04 system after security updates, the package is 1.5.4.

Does this guide work on Ubuntu 24.04 and 22.04?

Yes. Install the same package names on 24.04 or 22.04 LTS. All three supported LTS releases currently receive 1.5.4 through Ubuntu security updates, with the same paths and clamav-freshclam service layout described here.

Does ClamAV provide real-time protection?

Not with this install alone. clamscan and clamdscan run when you invoke them. Real-time Linux scanning needs clamonacc and extra configuration.

Do I need clamd or is clamscan enough?

clamscan is enough for manual or cron-style scans. clamd plus clamdscan helps when you scan often and can spare the RAM.

Does FreshClam update the ClamAV program?

No. freshclam updates signature files under /var/lib/clamav. Use apt to upgrade the ClamAV engine package.

Is EICAR real malware?

No. It is a standard test string. It does not execute. Delete test copies when you are done confirming FOUND output.

Finished reading?Beta Get the key takeaways in seconds, then ask follow-up questions
Omer Cakmak

Linux Administrator

Highly skilled at managing Debian, Ubuntu, CentOS, Oracle Linux, and Red Hat servers. Proficient in bash scripting, Ansible, and AWX central server management, he handles server operations on OpenStack, KVM, Proxmox, and VMware.

Expertise
  • Debian
  • Ubuntu
  • Linux
  • Red Hat Enterprise Linux
  • Shell Script
  • System Administration

Related Articles

linux

How to Install Velociraptor on Ubuntu

Install Velociraptor on Ubuntu 25.04: download the linux-amd64 binary, generate server.config.yaml, build the …

10 min readlinux

Does Ubuntu Need Antivirus?

Ubuntu does not ship Windows-style real-time antivirus. Learn when a home desktop can skip AV, when file or …

9 min readlinux

How to Install chkrootkit on Ubuntu

Install chkrootkit on Ubuntu 26.04, 24.04, and 22.04 from Universe, run rootkit scans with chkrootkit -q, read …

13 min read