The Ultimate Guide to Installing ClamAV on Ubuntu & Debian

This guide will show you how to easily set up, update, and run ClamAV to protect your Linux system from harmful files and viruses.

ClamAV

Server Security Basics

Ubuntu/Debian

What is ClamAV?

ClamAV is a popular, free, and open-source antivirus program designed to find viruses, malware, and other hidden threats. While it was first created to scan email attachments, it is now used to protect entire computer systems. System administrators love it because it is highly trusted, always gets new updates, and does not cost any money.

This antivirus works by checking your files against a huge list of known virus signatures that is updated every day. It does not have a normal visual menu with buttons; instead, you control it by typing simple text commands in your terminal. This makes the program very lightweight.

For dedicated servers, ClamAV is extremely important for keeping hosted files clean and safe. Even though Linux servers do not catch viruses easily, they often hold files, websites, or emails uploaded by Windows and Mac users. If a user uploads an infected file, ClamAV finds and removes it before it can spread to other people who visit or use the server.

Prerequisites

  • A dedicated server or computer running Ubuntu or Debian Linux.
  • A user account with sudo (administrator) privileges.
  • An active internet connection to download the software and virus updates.
  • At least 2GB of RAM (required if you plan to run the continuous background scanner).

Installation Paths

Before starting, you must decide which version of ClamAV fits your needs:
  • Path A (The Lightweight Setup): Best for occasional, manual scans. It saves RAM by only loading the virus database when a scan is actively running.
  • Path B (The High-Performance Setup): Best for frequent or instant scans. It runs a background daemon that keeps the massive database loaded in RAM (uses 1GB+ of memory) for zero-delay scanning.
1

Update System Packages

Ensure your package list is current
Open your terminal and run the following command to update your existing software:
BASH 
sudo apt update && sudo apt upgrade -y
2

Install ClamAV

Choose based on your preferred path
Install the packages that match the setup you chose above:
For Path A (Lightweight):
BASH 
sudo apt install clamav -y
For Path B (High-Performance Daemon):
BASH 
sudo apt install clamav clamav-daemon -y
3

Stop the FreshClam Service

Failing to do this locks the database
ClamAV uses a tool called FreshClam to update its virus database. Upon installation, it starts automatically. You must stop this service before the first manual update, or the update will fail.
BASH 
sudo systemctl stop clamav-freshclam
4

Manually Update the Virus Database

Download the latest virus definitions directly from the ClamAV servers. This may take a few minutes.
Bash 
sudo freshclam
5

Start and Enable Services

Now that your definitions are updated, safely start your services.
For Both Paths (Enable the Auto-Updater):
BASH 
sudo systemctl start clamav-freshclam
sudo systemctl enable clamav-freshclam
For Path B ONLY (Enable the Daemon):
BASH 
sudo systemctl start clamav-daemon
sudo systemctl enable clamav-daemon
6

Verify the Installation

To ensure everything installed successfully, check your version:
BASH 
clamscan --version
Verify that the automated updater is actively running in the background (press q to exit this view):
BASH 
sudo systemctl status clamav-freshclam

Basic Scanning Commands

Important: If you plan to use the --move commands below, ensure you create the quarantine directory first using mkdir /home/username/quarantine.

Path A Commands (Using clamscan)

Note : It takes 15-30 seconds to load the database before the scan begins.

  • Scan a specific file: clamscan /path/to/your/file.txt
  • Scan a directory recursively: clamscan -r /home/username/
  • Move infected files to quarantine: clamscan -r -i --move=/home/username/quarantine /home/username/

Path B Commands (Using clamdscan)

Note: It communicates with the daemon for instant scanning. You must use --fdpass to grant it permission to read your personal files.

  • Scan a specific file instantly: clamdscan --fdpass /path/to/your/file.txt
  • Scan a directory instantly: clamdscan --fdpass /home/username/
  • Move infected files to quarantine: clamdscan --fdpass --move=/home/username/quarantine /home/username/
  • Scan using all CPU cores (Fastest): clamdscan --fdpass --multiscan /home/username/
(Ubuntu Note: Even with --fdpass, Ubuntu's built-in AppArmor security may sometimes block clamdscan from scanning files in home directories. If you get "Permission denied" errors, you may need to scan using standard clamscan instead, or modify the AppArmor profiles.)

Final Thoughts

You have successfully secured your Linux server by setting up a powerful, open-source antivirus system.

  • Installed ClamAV: You set up the core antivirus software and chose between a lightweight manual scanner or a high-performance background daemon.
  • Configured FreshClam: You configured the automated update service to ensure your server always has the latest virus definitions.
  • Mastered Scanning Commands: You learned how to run both standard and multi-core scans to detect and quarantine infected files safely.

With these tools in place, your dedicated server is now a much safer environment for hosting and sharing files.

Explore Dedicated Servers

CTCservers Recommended Tutorials

Install-ROCm

Web, Network

Step-by-Step Guide: Install AMD ROCm on Ubuntu with RX 6600 GPU

Learn how to quickly and easily set up AMD ROCm on Ubuntu for your RX 6600 GPU, enabling powerful machine learning, AI workloads, and GPU-accelerated computing right on your system.
Install LAMP

Web, Network, Linux, Mysql, Ubuntu

LAMP Setup Guide 2026: Ubuntu & Debian | CTCservers

Install a secure LAMP stack on Debian or Ubuntu. Follow our step-by-step guide to configure Linux, Apache, MySQL, and PHP for your web server.
Deploy Phi-3

Web, Network, Ubuntu

Deploy Phi-3 with Ollama on Ubuntu GPU | CTCservers

Learn how to easily deploy the Phi-3 LLM on an Ubuntu 24.04 GPU server using Ollama and WebUI. Follow our step-by-step tutorial for seamless AI hosting.

Discover CTCservers Dedicated Server Locations

CTCservers servers are available around the world, providing diverse options for hosting websites. Each region offers unique advantages, making it easier to choose a location that best suits your specific hosting needs.