Install and Use ClamAV on Ubuntu 22.04: Best AntiVirus

In this guide on the Orcacore website, we want to teach you to Install and Use ClamAV on Ubuntu 22.04. Also, you will learn to Install ClamTK (Graphical User Interface for a ClamAV) on Ubuntu 22.04. This article will explore the process of setting up this powerful tool on your Ubuntu system and leveraging its capabilities for robust security.

Introduction To ClamAV:

ClamAV is a free, open-source antivirus. The program can detect viruses, trojans, and malware. One of ClamAV’s most popular applications is scanning emails on mail gateways and checking the attachment file in real time. ClamAV antivirus databases are constantly updated. The program supports the search for viruses in archives (in compressed files). ClamAV antivirus is managed through the command line. Although it is free, it is quite limited in its features. This guide focuses on helping you Install and Use ClamAV on Ubuntu 22.04 effectively.

ClamAV components consist of:

clamd (clamav-daemon) – This daemon is mainly responsible for loading the virus database to memory when scanning starts.

freshclam (clamav-freshclam) – This daemon is used to update, download, and install the Virus signature database.

clamdscan – Tool to scan files and directories for viruses.

clamonacc – This daemon provides on-access scanner functionality for ClamAV

To complete this guide, you must log in to your server as a non-root user with sudo privileges. To do this, you can follow our guide on Initial Server Setup with Ubuntu 22.04.

1. Install ClamAV Antivirus on Ubuntu 22.04

ClamAV packages are available in the default Ubuntu repository. First, update your local package index with the following command:

sudo apt update

Then, use the following command to install ClamAV packages on your server:

sudo apt install clamav clamav-daemon -y

You can verify your ClamAV installation by checking its version:

clamscan -V

**<mark>Output
</mark>**ClamAV 0.103.6/26813/Wed Feb 15 08:29:30 2023

By default, clamav-freshclam service will be enabled and running. At this point, you can verify it by checking its status:

sudo systemctl status clamav-freshclam

Note: If the service is not started, run the following command to start clamav-freshclam:

sudo systemctl start clamav-freshclam

2. Update ClamAV Signature Database for Viruses

At this point, you need to update the ClamAV Signature Database for Viruses. freshclam command is used to download and update ClamAV’s official virus signature databases.

First, stop the clamav-freshclam service by using the command below:

sudo systemctl stop clamav-freshclam

Then, download and update the database manually using the following command:

sudo freshclam

If you get the following output, then the database is updated:

At this point, you need to start your freshclam service again:

sudo systemctl start clamav-freshclam

Next, you need to start clamav-daemon service to load database definitions to memory:

sudo systemctl start clamav-daemon

Finally, you can check the ClamAV logs in /var/log/clamav/clamav.log:

tail /var/log/clamav/clamav.log

3. How To Test ClamAV Service?

At this point, we want to test the ClamAV service by downloading a test virus to /tmp directory and scanning by using clamscan tool. To do this, run the following commands:

# cd /tmp
# wget http://www.eicar.org/download/eicar.com
# clamscan --infected --remove eicar.com

4. How To Use ClamAV on Ubuntu 22.04?

The ClamAV configuration file is located at /etc/clamav/clamd.conf. The configuration file allows us to set scanning behavior, user name for clamd daemon (by default daemon is run by clamav), exclude directories from scanning, and much more.

ClamAV logs are stored in /var/log/clamav/, which contains information about each virus scan.

ClamAV comes with many inbuilt tools, among which clamscan is the most important tool. Clamscan is a clamd client used to scan files.

Let’s see some examples of using ClamAV.

From your current directory, you can scan all the files by using the command below:

clamscan -r /

You can scan the files but only show the infected files. To do this, you can use the command below:

clamscan -r -i /[<mark>path-to-folder</mark>]

Also, you can scan infected files in a specific directory recursively and then remove them by using the command below:

clamscan --infected --remove --recursive /home/ubuntu/Desktop/

The options used in the commands, means:

• -r or --recursive: Scan directories recursively.
• -i or --infected: Only show infected files.
• --remove: Remove infected files.

To scan your web server and everything in the standard Apache document root, you scan any suspicious files and unwanted applications with the following command:

sudo clamscan --infected --detect-pua=yes --recursive /var/www/html/

pua: Potential Unwanted Application

You can scan files and send the results of infected files to a new results file by using the command below:

clamscan -r /[<mark>path-to-folder</mark>] | grep FOUND >> /[<mark>path-folder</mark>]/[file].txt

Also, you can scan and move infected files to a different directory path by running the command below:

clamscan -r --move=/[<mark>path-to-folder</mark>] /[<mark>path-to-quarantine-folder</mark>]

To get more help about ClamAV, you can use the command below:

clamscan -h

Or, you can visit the ClamAV Documentation page.

5. Install ClamTK on Ubuntu 22.04

If you are more comfortable using GUI instead of the command line, you can install ClamTK. ClamTK is a Graphical User Interface for a ClamAV software program.

To install ClamTK, you can use the following command:

apt install clamtk -y

If you already have ClamAV installed on your system and need to upgrade it, use the command below:

apt --only-upgrade install clamav clamav-daemon

After installing clamTK, open it and you will get a nice GUI with all options including Configuration, History, Updates, and Analysis.

That’s it, you are done. Install and Use ClamAV on Ubuntu 22.04 is now complete!

Conclusion

At this point, you have learned to Install and Use ClamAV Antivirus on Ubuntu 22.04. Also, you have learned to Install ClamTK the graphical user interface of ClamAV on your Ubuntu server. This guide provided a comprehensive overview of how to Install and Use ClamAV on Ubuntu 22.04.

Hope you enjoy it. You may also interested in these articles:

Install and Configure Cacti on Ubuntu 22.04

Install Fathom Analytics on Ubuntu 22.04

Install XAMPP on Ubuntu 24.04

Ubuntu 22.04 SCPOnly Setup

Download and install Zabbix 6.0 LTS for Ubuntu 22.04

Install Mattermost Server on Ubuntu 22.04

How to Install the Latest Erlang on Ubuntu Linux

How To Setup Flarum discussion forum on Ubuntu 22.04

Alternative Solutions for Malware Detection on Ubuntu 22.04

While ClamAV is a solid choice, especially for its open-source nature, other approaches can enhance or replace it for malware detection on Ubuntu 22.04. Here are two alternative solutions:

1. Using OSSEC HIDS (Host-Based Intrusion Detection System):

OSSEC is a free, open-source HIDS that performs log analysis, file integrity checking, rootkit detection, and process monitoring. While not strictly an antivirus, its intrusion detection capabilities can identify malicious activity often associated with malware. It uses a signature-based approach (similar to antivirus software) combined with anomaly detection.

Explanation:

OSSEC works by installing an agent on the Ubuntu 22.04 system you want to protect. This agent collects logs, monitors file changes, and tracks running processes. It then sends this data to a central OSSEC server, which analyzes the data and generates alerts if any suspicious activity is detected.

How it differs from ClamAV:

• Scope: ClamAV focuses solely on identifying malware through signature matching. OSSEC provides a broader security perspective by monitoring various aspects of the system.
• Detection Method: ClamAV uses virus definitions. OSSEC uses log analysis, file integrity monitoring, and rootkit detection techniques in addition to signature-based matching.
• Centralized Management: OSSEC allows for centralized management of multiple agents from a single server, making it suitable for larger deployments. ClamAV typically operates on a per-system basis.

Code Example (Basic OSSEC Agent Installation):

First, add the OSSEC repository:

sudo apt update
sudo apt install apt-transport-https
wget -q -O - https://updates.atomicorp.com/installers/atomic.sh | sudo bash

Then, install the OSSEC agent:

sudo apt install ossec-hids-agent

Configure the agent to point to the OSSEC server (replace your_ossec_server_ip with the actual IP address):

sudo /var/ossec/bin/ossec-agent-control -i your_ossec_server_ip

2. Using Commercial Endpoint Detection and Response (EDR) Solutions:

Several commercial EDR solutions offer more advanced malware detection and response capabilities compared to ClamAV. Examples include CrowdStrike Falcon, SentinelOne, and Microsoft Defender for Endpoint.

Explanation:

EDR solutions go beyond traditional antivirus by providing real-time monitoring of endpoint activity, behavioral analysis, and automated response capabilities. They use machine learning and threat intelligence to identify and block even the most sophisticated malware.

How it differs from ClamAV:

• Advanced Threat Detection: EDR solutions use behavioral analysis and machine learning to detect zero-day exploits and fileless malware, which ClamAV may miss.
• Automated Response: EDR solutions can automatically isolate infected endpoints, kill malicious processes, and remediate threats without manual intervention.
• Threat Intelligence: EDR solutions leverage threat intelligence feeds to stay up-to-date on the latest threats and tactics.
• Forensic Analysis: EDR solutions provide detailed forensic analysis tools to investigate security incidents and identify the root cause of attacks.

Code Example (Conceptual – Actual installation varies by vendor):

While you won’t directly install EDR via apt like ClamAV, the general process involves:

1. Subscription: Purchase a license for the EDR solution.
2. Agent Download: Download the agent installer package from the vendor’s portal.
3. Installation Script: Run the installer script on the Ubuntu 22.04 system (often requires root privileges).

# Example (Conceptual - Adapt to vendor's instructions)
sudo ./vendor_edr_agent_installer.sh -k your_activation_key

Important Considerations:

• Cost: Commercial EDR solutions come with a subscription fee, while ClamAV and OSSEC are free.
• Complexity: EDR solutions can be more complex to configure and manage than ClamAV. OSSEC also requires more setup than ClamAV.
• Performance Impact: EDR solutions and OSSEC can have a greater impact on system performance than ClamAV due to their real-time monitoring and analysis capabilities.
• Specific Needs: The best solution depends on your specific security requirements, budget, and technical expertise.

Choosing the right malware detection solution involves carefully evaluating your organization’s needs and resources. While ClamAV offers a valuable starting point, exploring alternative solutions like OSSEC HIDS or commercial EDR platforms can provide a more comprehensive and robust security posture for your Ubuntu 22.04 systems.