ClamAV

Why this tool?

ClamAV is a popular tool to detect malicious software or malware. While it calls itself an antivirus engine, it probably won't encounter many viruses, as they have become rare. It is more likely to find other forms of malware like worms, backdoors, and ransomware. ClamAV can be used in a few ways, from doing an occasional scan up to scanning in batch. ClamAV does not do on-access scanning but can be combined with other tools to obtain similar functionality. ClamAV is often used to support scanning incoming emails for malicious content.

How it works

The tooling has several components, including a daemon process named clamd. By using a Milter interface, email can be scanned within mail applications like Sendmail and Postfix. Optionally, the command-line utility clamdscan can talk to the daemon and request scanning of data.

ClamAV uses a few definition databases which contain the fingerprints of malware samples. Each utility responsible for scanning will work with this set of databases. The freshclam tool is a helper utility to update these databases.

Background information

The ClamAV project has a long history and is currently under development by Cisco. This is an indirect acquisition, as first the Snort project was acquired by Sourcefire. Then Cisco acquired Sourcefire in 2013, making it the new owner of the project.