$ ls -l /var/lib/clamav/
total 171484
-rw-r--r-- 1 clamav clamav     9078 Oct  6 05:04 bytecode-339.cvd.sign
-rw-r--r-- 1 clamav clamav   281702 Oct  6 05:04 bytecode.cvd
-rw-r--r-- 1 clamav clamav 86205440 Oct  6 14:28 daily.cld
-rw-r--r-- 1 clamav clamav       90 Oct  6 05:02 freshclam.dat
-rw-r--r-- 1 clamav clamav     9078 Oct  6 05:04 main-63.cvd.sign
-rw-r--r-- 1 clamav clamav 89072577 Oct  6 05:04 main.cvd
$ du -sh /var/lib/clamav/
168M    /var/lib/clamav/

$ DEBIAN_FRONTEND=noninteractive apt-get install -y clamav clamav-daemon clamav-freshclam clamtk
Reading package lists...
Building dependency tree...
Reading state information...
The following additional packages will be installed:
  adwaita-icon-theme at-spi2-core ca-certificates clamav-base clamdscan cron
  dbus-user-session dconf-gsettings-backend dconf-service fontconfig
  fontconfig-config fonts-dejavu-core gir1.2-atk-1.0 gir1.2-freedesktop
  gir1.2-gdkpixbuf-2.0 gir1.2-gtk-3.0 gir1.2-harfbuzz-0.0 gir1.2-pango-1.0
  gnome-icon-theme gsettings-desktop-schemas gtk-update-icon-cache
  hicolor-icon-theme humanity-icon-theme libatk-bridge2.0-0 libatk1.0-0
  ...
The following NEW packages will be installed:
  adwaita-icon-theme at-spi2-core ca-certificates clamav clamav-base
  clamav-daemon clamav-freshclam clamdscan clamtk cron dbus-user-session
  ...
The following packages will be upgraded:
  perl-base
1 upgraded, 163 newly installed, 0 to remove and 9 not upgraded.
Need to get 62.5 MB of archives.
After this operation, 225 MB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 perl-base amd64 5.34.0-3ubuntu1.9 [1762 kB]
Get:6 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 clamav-base all 1.5.4+dfsg-0ubuntu0.22.04.1 [107 kB]
Get:7 http://archive.ubuntu.com/ubuntu jammy/main amd64 libbrotli1 amd64 1.0.9-2build6 [315 kB]
Get:17 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 libclamav12 amd64 1.5.4+dfsg-0ubuntu0.22.04.1 [8178 kB]
Get:18 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 clamav-freshclam amd64 1.5.4+dfsg-0ubuntu0.22.04.1 [105 kB]
Get:19 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 clamav-daemon amd64 1.5.4+dfsg-0ubuntu0.22.04.1 [234 kB]
Get:63 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 clamav amd64 1.5.4+dfsg-0ubuntu0.22.04.1 [7420 kB]
Get:64 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 clamdscan amd64 1.5.4+dfsg-0ubuntu0.22.04.1 [62.7 kB]
Get:147 http://archive.ubuntu.com/ubuntu jammy/universe amd64 clamtk all 6.07-1 [185 kB]
...
Fetched 62.5 MB in 11s (5798 kB/s)
(Reading database ... 7760 files and directories currently installed.)
Preparing to unpack .../061-clamav_1.5.4+dfsg-0ubuntu0.22.04.1_amd64.deb ...
Unpacking clamav (1.5.4+dfsg-0ubuntu0.22.04.1) ...
Unpacking clamdscan (1.5.4+dfsg-0ubuntu0.22.04.1) ...
Setting up clamav-base (1.5.4+dfsg-0ubuntu0.22.04.1) ...
Setting up libclamav12:amd64 (1.5.4+dfsg-0ubuntu0.22.04.1) ...
Setting up clamdscan (1.5.4+dfsg-0ubuntu0.22.04.1) ...
Setting up clamav-freshclam (1.5.4+dfsg-0ubuntu0.22.04.1) ...
invoke-rc.d: policy-rc.d denied execution of start.
Setting up clamav-daemon (1.5.4+dfsg-0ubuntu0.22.04.1) ...
invoke-rc.d: policy-rc.d denied execution of start.
Setting up clamtk (6.07-1) ...

$ freshclam --version
ClamAV 1.5.4/28144/Mon Oct  5 06:24:24 2026
$ clamscan --version
ClamAV 1.5.4/28145/Tue Oct  6 06:26:12 2026
$ clamdscan --version
WARNING: VERSION command disabled in clamd, printing the local version.
ClamAV 1.5.4
$ sigtool --version
ClamAV 1.5.4/28145/Tue Oct  6 06:26:12 2026

$ freshclam
ClamAV update process started at Tue Oct  6 05:02:54 2026
Tue Oct  6 05:02:54 2026 -> daily database available for download (remote version: 28144)
Testing database: '/var/lib/clamav/tmp.25a0704ef9/daily.cvd' ...
Database test passed.
Tue Oct  6 05:03:03 2026 -> daily.cvd updated (version: 28144, sigs: 355713, f-level: 90, builder: svc.clamav-publisher)
Tue Oct  6 05:03:03 2026 -> main database available for download (remote version: 63)
Testing database: '/var/lib/clamav/tmp.25a0704ef9/main.cvd' ...
Database test passed.
Tue Oct  6 05:04:28 2026 -> main.cvd updated (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
Tue Oct  6 05:04:28 2026 -> bytecode database available for download (remote version: 339)
Testing database: '/var/lib/clamav/tmp.25a0704ef9/bytecode.cvd' ...
Database test passed.
Tue Oct  6 05:04:30 2026 -> bytecode.cvd updated (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
WARNING: Clamd was NOT notified: The RELOAD command is disabled. Consider enabling it in the clamd configuration!

$ mkdir -p /opt/clamav-debs && cd /opt/clamav-debs
$ apt download clamav clamav-daemon clamav-freshclam clamdscan clamtk libclamav12 clamav-base

$ dpkg -i /opt/clamav-debs/*.deb

$ mkdir -p /opt/clamav-db && cd /opt/clamav-db
$ wget https://database.clamav.net/main.cvd
$ wget https://database.clamav.net/daily.cvd
$ wget https://database.clamav.net/bytecode.cvd

$ cp main.cvd daily.cvd bytecode.cvd /var/lib/clamav/
$ chown clamav:clamav /var/lib/clamav/*

LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup clamav
LocalSocketMode 666
User clamav
ScanMail true
ScanArchive true
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
LogSyslog false
LogRotate true
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PreludeEnable no
PreludeAnalyzerName ClamAV
DatabaseDirectory /var/lib/clamav
OfficialDatabaseOnly false
SelfCheck 3600
Foreground false
Debug false
ScanPE true
MaxEmbeddedPE 10M
ScanOLE2 true
ScanPDF true
ScanHTML true
MaxHTMLNormalize 10M
MaxHTMLNoTags 2M
MaxScriptNormalize 5M
MaxZipTypeRcg 1M
ScanSWF true
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
CrossFilesystems true
PhishingSignatures true
PhishingScanURLs true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
PartitionIntersection false
DetectPUA false
ScanPartialMessages false
HeuristicScanPrecedence false

# 开启控制命令（需要 clamdscan --reload / --version 时）
EnableReloadCommand true
EnableVersionCommand true
EnableStatsCommand true

# 日志落盘（默认走 syslog=false 时无文件日志，排障不便）
LogFile /var/log/clamav/clamav.log
LogTime yes
LogVerbose no
LogFileMaxSize 2M

# 流式扫描上限（超过该大小的文件在流式模式下被截断）
StreamMaxLength 100M

DatabaseOwner clamav
UpdateLogFile /var/log/clamav/freshclam.log
LogVerbose false
LogSyslog false
LogFacility LOG_LOCAL6
LogFileMaxSize 0
LogRotate true
LogTime true
Foreground false
Debug false
MaxAttempts 5
DatabaseDirectory /var/lib/clamav
DNSDatabaseInfo current.cvd.clamav.net
ConnectTimeout 30
ReceiveTimeout 0
TestDatabases yes
ScriptedUpdates yes
CompressLocalDatabase no
Bytecode true
CVDCertsDirectory /etc/clamav/certs
FIPSCryptoHashLimits yes
NotifyClamd /etc/clamav/clamd.conf
Checks 24
DatabaseMirror db.local.clamav.net
DatabaseMirror database.clamav.net

$ clamconf
Checking configuration files in /etc/clamav

Config file: clamd.conf
-----------------------
AlertExceedsMax disabled
CacheSize = "65536"
PreludeEnable disabled
PreludeAnalyzerName = "ClamAV"
LogFile = "/var/log/clamav/clamav.log"
LogFileUnlock disabled
LogFileMaxSize = "9223372036854775807"
LogTime = "yes"
LogClean disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
ExtendedDetectionInfo = "yes"
PidFile disabled
TemporaryDirectory disabled
DatabaseDirectory = "/var/lib/clamav"
CVDCertsDirectory = "/etc/clamav/certs"
OfficialDatabaseOnly disabled
FailIfCvdOlderThan disabled
LocalSocket = "/var/run/clamav/clamd.ctl"
LocalSocketGroup = "clamav"
LocalSocketMode = "666"
FixStaleSocket = "yes"
TCPSocket disabled
EnableShutdownCommand disabled
EnableReloadCommand disabled
EnableVersionCommand disabled
EnableStatsCommand disabled
TCPAddr disabled
MaxConnectionQueueLength = "15"
StreamMaxLength = "26214400"
StreamMinPort = "1024"
StreamMaxPort = "2048"
MaxThreads = "12"
ReadTimeout = "180"
CommandReadTimeout = "30"
SendBufTimeout = "200"
MaxQueue = "100"
IdleTimeout = "30"
ExcludePath disabled
MaxDirectoryRecursion = "15"
FollowDirectorySymlinks disabled
FollowFileSymlinks disabled
CrossFilesystems = "yes"
SelfCheck = "3600"
ConcurrentDatabaseReload = "yes"
DisableCache disabled
VirusEvent disabled
ExitOnOOM disabled
AllowAllMatchScan = "yes"
Foreground disabled
Debug disabled
LeaveTemporaryFiles disabled
GenerateMetadataJson disabled
JsonStoreHTMLURIs disabled

clamscan [选项] [文件/目录/-]

$ clamscan --version
ClamAV 1.5.4/28145/Tue Oct  6 06:26:12 2026

                       Clam AntiVirus: Scanner 1.5.4
           By The ClamAV Team: https://www.clamav.net/about.html#credits
           (C) 2025 Cisco Systems, Inc.

    clamscan [options] [file/directory/-]

    --help                -h             Show this help.
    --version             -V             Print version number.
    --verbose             -v             Be verbose.
    --archive-verbose     -a             Show filenames inside scanned archives.
    --debug                              Enable libclamav's debug messages.
    --quiet                              Only output error messages.
    --stdout                             Write to stdout instead of stderr. Does not affect 'debug' messages.
    --no-summary                         Disable summary at end of scanning.
    --infected            -i             Only print infected files.
    --suppress-ok-results -o             Skip printing OK files.
    --bell                               Sound bell on virus detection.

    --tempdir=DIRECTORY                  Create temporary files in DIRECTORY.
    --leave-temps[=yes/no(*)]            Do not remove temporary files.
    --force-to-disk[=yes/no(*)]          Create temporary files for nested file scans that would otherwise be in-memory only.
    --gen-json[=yes/no(*)]               Generate JSON metadata for the scanned file(s). For testing & development use ONLY.
                                         JSON will be printed if --debug is enabled.
                                         A JSON file will dropped to the temp directory if --leave-temps is enabled.
    --json-store-html-uris[=yes(*)/no]   Store html URIs in metadata.
                                         URIs will be written to the metadata.json file in an array called 'URIs'.
    --json-store-pdf-uris[=yes(*)/no]    Store pdf URIs in metadata.
                                         URIs will be written to the metadata.json file in an array called 'URIs'.
    --json-store-extra-hashes[=yes(*)/no] Store md5 and sha1 in addition to sha2-256 in metadata.
    --database=FILE/DIR   -d FILE/DIR    Load virus database from FILE or load all supported db files from DIR.
    --official-db-only[=yes/no(*)]       Only load official signatures.
    --fail-if-cvd-older-than=days        Return with a nonzero error code if virus database outdated.
    --log=FILE            -l FILE        Save scan report to FILE.
    --recursive[=yes/no(*)]  -r          Scan subdirectories recursively.
    --allmatch[=yes/no(*)]   -z          Continue scanning within file after finding a match.
    --cross-fs[=yes(*)/no]               Scan files and directories on other filesystems.
    --follow-dir-symlinks[=0/1(*)/2]     Follow directory symlinks (0 = never, 1 = direct, 2 = always).
    --follow-file-symlinks[=0/1(*)/2]    Follow file symlinks (0 = never, 1 = direct, 2 = always).
    --file-list=FILE      -f FILE        Scan files from FILE.

    --remove[=yes/no(*)]                 Remove infected files. Be careful!
    --move=DIRECTORY                     Move infected files into DIRECTORY.
    --copy=DIRECTORY                     Copy infected files into DIRECTORY.
    --exclude=REGEX                      Don't scan file names matching REGEX.
    --exclude-dir=REGEX                  Don't scan directories matching REGEX.
    --include=REGEX                      Only scan file names matching REGEX.
    --include-dir=REGEX                  Only scan directories matching REGEX.

    --bytecode[=yes(*)/no]               Load bytecode from the database.
    --bytecode-unsigned[=yes/no(*)]      Load unsigned bytecode.
                                         **Caution**: You should NEVER run bytecode signatures from untrusted sources.
                                         Doing so may result in arbitrary code execution.
    --bytecode-timeout=N                 Set bytecode timeout (in milliseconds).
    --statistics[=none(*)/bytecode/pcre] Collect and print execution statistics.
    --detect-pua[=yes/no(*)]             Detect Possibly Unwanted Applications.
    --exclude-pua=CAT                    Skip PUA sigs of category CAT.
    --include-pua=CAT                    Load PUA sigs of category CAT.
    --detect-structured[=yes/no(*)]      Detect structured data (SSN, Credit Card).
    --structured-ssn-format=X            SSN format (0=normal,1=stripped,2=both).
    --structured-ssn-count=N             Min SSN count to generate a detect.
    --structured-cc-count=N              Min CC count to generate a detect.
    --structured-cc-mode=X               CC mode (0=credit debit and private label, 1=credit cards only.
    --scan-mail[=yes(*)/no]              Scan mail files.
    --phishing-sigs[=yes(*)/no]          Enable email signature-based phishing detection.
    --phishing-scan-urls[=yes(*)/no]     Enable URL signature-based phishing detection.
    --heuristic-alerts[=yes(*)/no]       Heuristic alerts.
    --heuristic-scan-precedence[=yes/no(*)] Stop scanning as soon as a heuristic match is found.
    --normalize[=yes(*)/no]              Normalize html, script, and text files. Use normalize=no for yara compatibility.
    --scan-pe[=yes(*)/no]                Scan PE files.
    --scan-elf[=yes(*)/no]               Scan ELF files.
    --scan-ole2[=yes(*)/no]              Scan OLE2 files.
    --scan-pdf[=yes(*)/no]               Scan PDF files.
    --scan-swf[=yes(*)/no]               Scan SWF files.
    --scan-html[=yes(*)/no]              Scan HTML files.
    --scan-xmldocs[=yes(*)/no]           Scan xml-based document files.
    --scan-hwp3[=yes(*)/no]              Scan HWP3 files.
    --scan-onenote[=yes(*)/no]           Scan OneNote files.
    --scan-archive[=yes(*)/no]           Scan archive files (supported by libclamav).
    --scan-image[=yes(*)/no]             Scan image (graphics) files.
    --scan-image-fuzzy-hash[=yes(*)/no]  Detect files by calculating image (graphics) fuzzy hashes.
    --alert-broken[=yes/no(*)]           Alert on broken executable files (PE & ELF).
    --alert-broken-media[=yes/no(*)]     Alert on broken graphics files (JPEG, TIFF, PNG, GIF).
    --alert-encrypted[=yes/no(*)]        Alert on encrypted archives and documents.
    --alert-encrypted-archive[=yes/no(*)] Alert on encrypted archives.
    --alert-encrypted-doc[=yes/no(*)]    Alert on encrypted documents.
    --alert-macros[=yes/no(*)]           Alert on OLE2 files containing VBA macros.
    --alert-exceeds-max[=yes/no(*)]      Alert on files that exceed max file size, max scan size, or max recursion limit.
    --alert-phishing-ssl[=yes/no(*)]     Alert on emails containing SSL mismatches in URLs.
    --alert-phishing-cloak[=yes/no(*)]   Alert on emails containing cloaked URLs.
    --alert-partition-intersection[=yes/no(*)] Alert on raw DMG image files containing partition intersections.
    --nocerts                            Disable authenticode certificate chain verification in PE files.
    --dumpcerts                          Dump authenticode certificate chain in PE files.

    --max-scantime=#n                    Scan time longer than this will be skipped and assumed clean (milliseconds).
    --max-filesize=#n                    Files larger than this will be skipped and assumed clean.
    --max-scansize=#n                    The maximum amount of data to scan for each nested archive (**).
    --max-files=#n                       The maximum number of files to scan for each nested archive (**).
    --max-recursion=#n                   Maximum archive recursion level for nested archive (**).
    --max-dir-recursion=#n               Maximum directory recursion level.
    --max-embeddedpe=#n                  Maximum size file to check for embedded PE.
    --max-htmlnormalize=#n               Maximum size of HTML file to normalize.
    --max-htmlnotags=#n                  Maximum size of normalized HTML file to scan.
    --max-scriptnormalize=#n             Maximum size of script file to normalize.
    --max-ziptypercg=#n                  Maximum size zip to type reanalyze.
    --max-partitions=#n                  Maximum number of partitions in disk image to be scanned.
    --max-iconspe=#n                     Maximum number of icons in PE file to be scanned.
    --max-rechwp3=#n                     Maximum recursive calls to HWP3 parsing function.
    --pcre-match-limit=#n                Maximum calls to the PCRE match function.
    --pcre-recmatch-limit=#n             Maximum recursive calls to the PCRE match function.
    --pcre-max-filesize=#n               Maximum size file to perform PCRE subsig matching.

Environment Variables:

    LD_LIBRARY_PATH                      May be used on startup to find the libclamunrar_iface
                                         shared library module to enable RAR archive support.
    CVD_CERTS_DIR                        Specify a directory containing the root CA cert needed
                                         to verify detached CVD digital signatures.
                                         If not provided, then clamscan will look in the default directory.

Pass in - as the filename for stdin.

(*) Default scan settings
(**) Certain files (e.g. documents, archives, etc.) may in turn contain other
   files inside. The above options ensure safe processing of this kind of data.

$ clamscan /tmp/eicar.txt
/tmp/eicar.txt: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 3628131
Engine version: 1.5.4
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 69 B
Data read: 69 B (ratio 1.00:1)
Time: 13.285 sec (0 m 13 s)
Start Date: 2026:10:06 05:04:38
End Date:   2026:10:06 05:04:51

freshclam [选项]

$ freshclam --version
ClamAV 1.5.4/28144/Mon Oct  5 06:24:24 2026

                      Clam AntiVirus: Database Updater 1.5.4
           By The ClamAV Team: https://www.clamav.net/about.html#credits
           (C) 2025 Cisco Systems, Inc.

    freshclam [options]

    --help               -h              Show this help
    --version            -V              Print version number and exit
    --verbose            -v              Be verbose
    --debug                              Enable debug messages
    --quiet                              Only output error messages
    --no-warnings                        Don't print and log warnings
    --stdout                             Write to stdout instead of stderr.
                                         Does not affect 'debug' messages.
    --show-progress                      Show download progress percentage

    --config-file=FILE                   Read configuration from FILE.
    --log=FILE           -l FILE         Log into FILE
    --daemon             -d              Run in daemon mode
    --pid=FILE           -p FILE         Write the daemon's pid to FILE
    --foreground         -F              Don't fork into background (for use in daemon mode).
    --user=USER          -u USER         Run as USER
    --no-dns                             Force old non-DNS verification method
    --checks=#n          -c #n           Number of checks per day, 1 <= n <= 50
    --datadir=DIRECTORY                  Download new databases into DIRECTORY
                                         NOTE: DIRECTORY must already exist, be an absolute path, and
                                         be writeable by freshclam and readable by clamd/clamscan.
    --daemon-notify[=/path/clamd.conf]   Send RELOAD command to clamd
    --local-address=IP   -a IP           Bind to IP for HTTP downloads
    --on-update-execute=COMMAND          Execute COMMAND after successful update.
                                         Use EXIT_1 to return 1 after successful database update.
    --on-error-execute=COMMAND           Execute COMMAND if errors occurred
    --on-outdated-execute=COMMAND        Execute COMMAND when software is outdated
    --update-db=DBNAME                   Only update database DBNAME
    --cvdcertsdir=DIRECTORY              Specify a directory containing the root
                                         CA cert needed to verify detached CVD digital signatures.
                                         If not provided, then freshclam will look in the default directory.

Environment Variables:

    CURL_CA_BUNDLE                       May be set to the path of a file (bundle)
                                         containing one or more CA certificates.
                                         This will override the default openssl
                                         certificate path.
    FRESHCLAM_CLIENT_CERT                May be set to the path of a file (PEM)
                                         containing the client certificate.
                                         This may be used for client authentication
                                         to a private mirror.
    FRESHCLAM_CLIENT_KEY                 May be set to the path of a file (PEM)
                                         containing the client private key.
                                         This is required if FRESHCLAM_CLIENT_CERT is set.
    FRESHCLAM_CLIENT_KEY_PASSWD          May be set to a password for the client key PEM file.
                                         This is required if FRESHCLAM_CLIENT_KEY is
                                         set and the PEM file is password protected.
    CVD_CERTS_DIR                        Specify a directory containing the root CA cert needed
                                         to verify detached CVD digital signatures.
                                         If not provided, then freshclam will look in the default directory.

$ freshclam -v
Tue Oct  6 14:28:14 2026 -> Current working dir is /var/lib/clamav/
Tue Oct  6 14:28:14 2026 -> Loaded freshclam.dat:
Tue Oct  6 14:28:14 2026 ->   version:    1
Tue Oct  6 14:28:14 2026 ->   uuid:       773eb4ab-9003-450b-99bc-f94eb91a8ec8
ClamAV update process started at Tue Oct  6 14:28:14 2026
Tue Oct  6 14:28:14 2026 -> Current working dir is /var/lib/clamav/
Tue Oct  6 14:28:14 2026 -> Querying current.cvd.clamav.net
Tue Oct  6 14:28:14 2026 -> TTL: 5

clamdscan [选项] [文件/目录/-]

$ clamdscan --version
WARNING: VERSION command disabled in clamd, printing the local version.
ClamAV 1.5.4

                      Clam AntiVirus: Daemon Client 1.5.4
           By The ClamAV Team: https://www.clamav.net/about.html#credits
           (C) 2025 Cisco Systems, Inc.

    clamdscan [options] [file/directory/-]

    --help              -h             Show this help
    --version           -V             Print version number and exit
    --verbose           -v             Be verbose
    --quiet                            Be quiet, only output error messages
    --stdout                           Write to stdout instead of stderr. Does not affect 'debug' messages.
                                       (this help is always written to stdout)
    --log=FILE          -l FILE        Save scan report in FILE
    --file-list=FILE    -f FILE        Scan files from FILE
    --ping              -p A[:I]       Ping clamd up to [A] times at optional interval [I] until it responds.
    --wait              -w             Wait up to 30 seconds for clamd to start. Optionally use alongside --ping to set attempts [A] and interval [I] to check clamd.
    --remove                           Remove infected files. Be careful!
    --move=DIRECTORY                   Move infected files into DIRECTORY
    --copy=DIRECTORY                   Copy infected files into DIRECTORY
    --config-file=FILE    -c           Read configuration from FILE.
    --allmatch            -z           Continue scanning within file after finding a match.
    --multiscan           -m           Force MULTISCAN mode
    --infected            -i           Only print infected files
    --no-summary                       Disable summary at end of scanning
    --reload                           Request clamd to reload virus database
    --fdpass                           Pass filedescriptor to clamd (useful if clamd is running as a different user)
    --stream                           Force streaming files to clamd (for debugging and unit testing)

$ clamdscan --ping
clamdscan: option `--ping' requires an argument
ERROR: Incomplete option passed (missing argument)
ERROR: Can't parse command line options

$ clamdscan --ping=10
PONG

$ clamdscan /tmp/eicar.txt
/tmp/eicar.txt: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 12.507 sec (0 m 12 s)
Start Date: 2026:10:06 05:05:01
End Date:   2026:10:06 05:05:14

$ clamdscan --reload
ERROR: Clamd did not reload the database

$ clamdscan --stats
clamdscan: unrecognized option `--stats'
ERROR: Unknown option passed
ERROR: Can't parse command line options

$ clamconf | grep -E "LocalSocket|LocalSocketMode|User|MaxThreads|Checks|DatabaseMirror|EnableReloadCommand"
LocalSocket = "/var/run/clamav/clamd.ctl"
LocalSocketGroup = "clamav"
LocalSocketMode = "666"
EnableReloadCommand disabled
EnableVersionCommand disabled
MaxThreads = "12"
Checks = "24"
DatabaseMirror = "db.local.clamav.net", "database.clamav.net"

Config file: freshclam.conf
---------------------------
LogFileMaxSize = "9223372036854775807"
LogTime = "yes"
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
PidFile disabled
DatabaseDirectory = "/var/lib/clamav"
CVDCertsDirectory = "/etc/clamav/certs"
Foreground disabled
Debug disabled
FIPSCryptoHashLimits = "yes"
UpdateLogFile = "/var/log/clamav/freshclam.log"
DatabaseOwner = "clamav"
Checks = "24"
DNSDatabaseInfo = "current.cvd.clamav.net"
DatabaseMirror = "db.local.clamav.net", "database.clamav.net"
PrivateMirror disabled
MaxAttempts = "5"
ScriptedUpdates = "yes"
TestDatabases = "yes"
CompressLocalDatabase disabled
ExtraDatabase disabled
ExcludeDatabase disabled
DatabaseCustomURL disabled
HTTPProxyServer disabled
HTTPProxyPort disabled
HTTPProxyUsername disabled
HTTPProxyPassword disabled
HTTPUserAgent disabled
NotifyClamd = "/etc/clamav/clamd.conf"
OnUpdateExecute disabled
OnErrorExecute disabled
OnOutdatedExecute disabled
LocalIPAddress disabled
ConnectTimeout = "30"
ReceiveTimeout disabled
Bytecode = "yes"

$ sigtool --version
ClamAV 1.5.4/28145/Tue Oct  6 06:26:12 2026

$ sigtool --info /var/lib/clamav/main.cvd
File: /var/lib/clamav/main.cvd
Build time: 16 Dec 2025 23:18 +0000
Version: 63
Signatures: 3287027
Functionality level: 90
Builder: tomjudge
MD5: 9c353a6b32555186a45a61c6441f38c0
Digital signature: gI9w3cezaElJbedEoiykyQeX1f6j9Xbs3a+cf9U/kH5QScGMe2mRz1K2JlYOrqfBuOUMbiKmvkVvAquOsMeDp/ejLVDx5WulC6klZVhLOfBHda29OjaLZwEGR9GPIHDr0mXriv7pivuMH60/loxpASIJHLOszyj95pxVK+EaTCh
Verification OK.

    sigtool [options]

    --help                 -h              Show this help
    --version              -V              Print version number and exit
    --quiet                                Be quiet, output only error messages
    --debug                                Enable debug messages
    --stdout                               Write to stdout instead of stderr. Does not affect 'debug' messages.
    --tempdir=DIRECTORY                    Create temporary files in DIRECTORY
    --leave-temps[=yes/no(*)]              Do not remove temporary files
    --datadir=DIR                          Use DIR as default database directory

  Commands for working with signatures:

    --list-sigs[=FILE]     -l[FILE]        List signature names
    --find-sigs=REGEX      -fREGEX         Find signatures matching REGEX
    --decode-sigs                          Decode signatures from stdin
    --test-sigs=DATABASE TARGET_FILE       Test signatures from DATABASE against
                                           TARGET_FILE

  Commands to generate signatures:

    --md5 [FILES]                          Generate MD5 hash from stdin
                                           or MD5 sigs for FILES
    --sha1 [FILES]                         Generate SHA1 hash from stdin
                                           or SHA1 sigs for FILES
    --sha2-256 [FILES]                     Generate SHA2-256 hash from stdin
                                           or SHA2-256 sigs for FILES
    --mdb [FILES]                          Generate .mdb (section hash) sigs
    --imp [FILES]                          Generate .imp (import table hash) sigs
    --fuzzy-img FILE(S)                    Generate image fuzzy hash for each file

  Commands to normalize files, so you can write more generic signatures:

    --html-normalise=FILE                  Create normalised parts of HTML file
    --ascii-normalise=FILE                 Create normalised text file from ascii source

$ dpkg -l clamtk | tail -1
ii  clamtk   6.07-1   all   graphical front-end for ClamAV

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

$ printf 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.txt
$ wc -c /tmp/eicar.txt
68 /tmp/eicar.txt
$ md5sum /tmp/eicar.txt
44d88612fea8a8f36de82e1278abb02f  /tmp/eicar.txt

$ clamscan /tmp/eicar.txt
/tmp/eicar.txt: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 3628131
Engine version: 1.5.4
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 68 B
Data read: 68 B (ratio 1.00:1)
Time: 16.560 sec (0 m 16 s)
Start Date: 2026:10:06 14:31:52
End Date:   2026:10:06 14:32:09

$ clamscan --remove /tmp/eicar.txt
/tmp/eicar.txt: Eicar-Test-Signature FOUND
/tmp/eicar.txt: Removed.

----------- SCAN SUMMARY -----------
Known viruses: 3628131
Engine version: 1.5.4
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 68 B
Data read: 68 B (ratio 1.00:1)
Time: 16.365 sec (0 m 16 s)
Start Date: 2026:10:06 14:32:09
End Date:   2026:10:06 14:32:25

$ ls -l /tmp/eicar.txt
ls: cannot access '/tmp/eicar.txt': No such file or directory

$ clamscan --no-summary /tmp/eicar.txt
/tmp/eicar.txt: Eicar-Test-Signature FOUND

$ clamscan -r -i /var/log
/var/log/eicar-test.txt: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 3628131
Engine version: 1.5.4
Scanned directories: 10
Scanned files: 23
Infected files: 1
Data scanned: 36.88 MiB
Data read: 17.30 MiB (ratio 2.13:1)
Time: 20.815 sec (0 m 20 s)
Start Date: 2026:10:06 14:33:07
End Date:   2026:10:06 14:33:28

$ freshclam
ClamAV update process started at Tue Oct  6 05:02:54 2026
Tue Oct  6 05:02:54 2026 -> daily database available for download (remote version: 28144)
...
Tue Oct  6 05:04:30 2026 -> bytecode.cvd updated (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
WARNING: Clamd was NOT notified: The RELOAD command is disabled. Consider enabling it in the clamd configuration!

$ systemctl start clamav-daemon && systemctl status clamav-daemon --no-pager
● clamav-daemon.service - Clam AntiVirus userspace daemon
     Loaded: loaded (/lib/systemd/system/clamav-daemon.service; disabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/clamav-daemon.service.d
             └─extend.conf
     Active: active (running) since Tue 2026-10-06 05:05:01 UTC; 10ms ago
TriggeredBy: ● clamav-daemon.socket
       Docs: man:clamd(8)
             man:clamd.conf(5)
             https://docs.clamav.net/
    Process: 37114 ExecStartPre=/bin/mkdir -p /run/clamav (code=exited, status=0/SUCCESS)
    Process: 37115 ExecStartPre=/bin/chown clamav /run/clamav (code=exited, status=0/SUCCESS)
   Main PID: 37116 (clamd)
      Tasks: 1 (limit: 5753)
     Memory: 1.0M
        CPU: 11ms
     CGroup: /system.slice/...
             └─37116 /usr/sbin/clamd --foreground=true

$ systemctl enable --now clamav-daemon clamav-freshclam
Synchronizing state of clamav-daemon.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable clamav-daemon
Synchronizing state of clamav-freshclam.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable clamav-freshclam
Created symlink /etc/systemd/system/multi-user.target.wants/clamav-daemon.service → /lib/systemd/system/clamav-daemon.service.
Created symlink /etc/systemd/system/sockets.target.wants/clamav-daemon.socket → /lib/systemd/system/clamav-daemon.socket.
Created symlink /etc/systemd/system/multi-user.target.wants/clamav-freshclam.service → /lib/systemd/system/clamav-freshclam.service.

$ systemctl status clamav-daemon clamav-freshclam --no-pager
● clamav-daemon.service - Clam AntiVirus userspace daemon
     Loaded: loaded (/lib/systemd/system/clamav-daemon.service; disabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/clamav-daemon.service.d
             └─extend.conf
     Active: active (running) since Tue 2026-10-06 05:05:01 UTC; 9h ago
TriggeredBy: ● clamav-daemon.socket
   Main PID: 37116 (clamd)
● clamav-freshclam.service - ClamAV virus database updater
     Loaded: loaded (/lib/systemd/system/clamav-freshclam.service; disabled; vendor preset: enabled)
     Active: active (running) since Tue 2026-10-06 14:34:10 UTC; 14ms ago
       Docs: man:freshclam(1)
             man:freshclam.conf(5)
             https://docs.clamav.net/
   Main PID: 532480 (freshclam)

$ clamdscan --ping=10
PONG
$ clamdscan --version
WARNING: VERSION command disabled in clamd, printing the local version.
ClamAV 1.5.4

systemctl enable --now clamav-daemon
systemctl start clamav-daemon
systemctl stop clamav-daemon
systemctl restart clamav-daemon
systemctl status clamav-daemon
systemctl is-active clamav-daemon
systemctl is-enabled clamav-daemon
systemctl disable clamav-daemon
systemctl enable --now clamav-freshclam
systemctl start clamav-freshclam
systemctl stop clamav-freshclam
systemctl restart clamav-freshclam
systemctl status clamav-freshclam
systemctl is-active clamav-freshclam
systemctl is-enabled clamav-freshclam
systemctl disable clamav-freshclam
systemctl status clamav-daemon.socket
journalctl -u clamav-daemon -f
journalctl -u clamav-freshclam -f

$ systemctl restart clamav-freshclam && systemctl is-active clamav-freshclam
active
$ systemctl restart clamav-daemon && systemctl is-active clamav-daemon
active
$ systemctl is-enabled clamav-daemon clamav-freshclam
enabled
enabled

$ clamdscan --version
ClamAV 1.5.4
ERROR: Could not connect to clamd on LocalSocket /var/run/clamav/clamd.ctl: No such file or directory

$ echo "EnableReloadCommand true" >> /etc/clamav/clamd.conf
$ systemctl restart clamav-daemon

$ systemctl stop clamav-freshclam
$ freshclam
$ systemctl start clamav-freshclam
# 或直接重启守护进程让新库生效
$ systemctl restart clamav-daemon

$ echo "EnableReloadCommand true" >> /etc/clamav/clamd.conf
$ systemctl restart clamav-daemon
$ clamdscan --reload        # 成功时无输出、退出码 0

30 2 * * * /usr/bin/clamscan -r -i / --exclude-dir=/proc --exclude-dir=/sys --exclude-dir=/dev --exclude-dir=/run --exclude-dir=/snap --log=/var/log/clamscan-daily.log

$ clamdscan --ping
clamdscan: option `--ping' requires an argument
ERROR: Incomplete option passed (missing argument)
ERROR: Can't parse command line options

$ clamdscan --ping=10
PONG

$ clamscan -r --follow-dir-symlinks=2 /home

apt-get remove -y clamtk clamav-daemon clamav-freshclam clamav clamdscan
apt-get autoremove -y

apt-get purge -y clamtk clamav-daemon clamav-freshclam clamav clamdscan
rm -rf /var/lib/clamav
rm -rf /var/log/clamav
systemctl daemon-reload