Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
FREEDOM251

Freedom251 › Blog › ClamAV

Install ClamAV on Ubuntu Linux: Packages, Updates, and Your First Scan

By Freedom251 Team · · 12 min read

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

To install ClamAV on Ubuntu, update APT and install the distribution package with sudo apt install clamav. Add clamav-daemon only if you need a persistent scanning service. Before any scan, run sudo freshclam so the official virus databases are present and current, then scan a file with clamscan /path/to/file or a directory recursively with clamscan -r /path/to/directory. This setup gives you a command-line malware scanner; installing the packages alone does not create an always-on desktop antivirus interface or prove that real-time protection is enabled.

What does installing ClamAV on Ubuntu actually provide?

ClamAV is an open-source antivirus engine that Ubuntu distributes through its normal package repositories. The basic clamav package supplies the command-line scanner, while clamav-daemon supplies a persistent scanning daemon for deployments that need a continuously running service.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The distinction matters because a package installation is not the same as a complete desktop security suite. The command-line program, clamscan, is intended for one-time scans with minimal setup. It examines the files or directories you specify when you run it; it does not automatically watch every file opened on the system. A daemon is a separate operating choice that may require its own service and configuration checks.

ClamAV documentation describes clamscan as a command-line tool for simple scanning tasks and says it is best suited to one-time scanning with minimal setup. The same documentation distinguishes it from clamd, the persistent daemon. That makes the command-line package the sensible starting point for a personal Ubuntu machine or an occasional manual check.

#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.

Which ClamAV installation should you choose?

Choose the smallest package set that matches the way you will scan. You can add the daemon later without reinstalling Ubuntu or replacing the signature database.

Use case Packages How you scan What you must configure
Occasional, one-time checks clamav Run clamscan against a chosen file or directory Install the package and update databases with freshclam
Repeated or service-based scanning clamav plus clamav-daemon Use the daemon-oriented deployment after checking the service and package configuration Review the Ubuntu configuration under /etc/clamav and verify service behavior on your release

Do not install the daemon merely because it sounds more complete. If your goal is a single scan of a download, home directory, or mounted volume, the command-line package avoids unnecessary service configuration. If another application or a recurring workflow needs a long-running scanner, install the daemon package and treat that as a separate deployment step.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What are the Ubuntu and hardware requirements?

ClamAV’s project documentation lists Ubuntu 24.04 and Ubuntu 22.04 on both x86_64 and arm64 among the platforms it regularly tests. That is a tested-platform list at the time of the documentation, not a claim that every other Ubuntu release is unable to run ClamAV. Package availability and versions depend on your Ubuntu release and architecture.

  • Memory: ClamAV recommends 3 GiB or more of RAM for Linux server and non-server editions. This is a project recommendation, not an installer-enforced minimum.
  • Disk: The project recommends 5 GiB of free disk space for the ClamAV application, in addition to the space required by Ubuntu and your databases.
  • Privileges: Installing packages and updating system-wide databases normally requires an account that can use sudo.
  • Network access: The first signature update needs access to ClamAV’s database distribution service. A scan can use databases already stored locally, but they must exist before the scanner starts.
  • Repository access: Ubuntu must have an enabled package source that contains the ClamAV packages for your release and architecture.

The figures above should be read as planning guidance. They do not guarantee a particular scan speed, and they are not a promise that every Ubuntu installation will expose exactly the same package version.

How do I check my Ubuntu release, architecture, and package candidate?

Checking these values first prevents you from assuming that a package version or repository path applies to every Ubuntu system.

  1. Display the release information with lsb_release -a. If that command is unavailable, inspect the release files under /etc or use your distribution’s system-information utility.
  2. Display the CPU architecture that APT uses with dpkg --print-architecture. Ubuntu package metadata can differ between x86_64 and arm64.
  3. Ask APT which ClamAV versions are available with apt policy clamav. The output shows the installed version, if any, and the candidate version offered by your configured repositories.
  4. Check the daemon package separately when you intend to use it: apt policy clamav-daemon.

Do not copy a version number from a package listing and expect it to be universal. Ubuntu’s Noble package metadata, for example, shows architecture-dependent values, and other Ubuntu releases can carry different revisions. Let your release repositories select the candidate unless you have a specific administrative reason to pin a package.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How do I install ClamAV from Ubuntu’s repositories?

Use APT rather than downloading an unrelated installer. Ubuntu packages are derived from Debian packages, and ClamAV’s package guidance directs Ubuntu users to the Debian-style package workflow.

Minimal installation for a manual scan

  1. Refresh the local package index:
sudo apt update
  1. Install the command-line scanner:
sudo apt install clamav
  1. Confirm that the executable is available:
clamscan --version

The version output reflects your Ubuntu release and architecture. It is a verification that the command is installed, not a reason to compare your number with a number from another release.

Installation that also includes the daemon

If a persistent scanner is required, install both packages after updating APT:

Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
sudo apt update
sudo apt install clamav clamav-daemon

The daemon package does not change the basic syntax of a one-time clamscan run. It adds a separate service-oriented option. Whether that service is enabled or started automatically depends on the package configuration and your Ubuntu release, so check its status instead of assuming that installation enabled real-time protection.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How do I update ClamAV’s virus definitions?

Run FreshClam before your first scan. ClamAV documentation states that database files must be installed before either clamscan or clamd can scan, and identifies freshclam as the tool that downloads and updates the official signature databases.

sudo freshclam

FreshClam downloads current database files when updates are available and reports what it did in the terminal. The Ubuntu APT configuration uses /etc/clamav, so package-managed FreshClam settings and related configuration are normally found there. Keep the package’s configuration structure intact unless you have a specific reason to change it.

A successful package installation without a successful database update is not a complete setup. If the machine is offline, the update cannot download new definitions; wait until network access is available, then run FreshClam again. If you administer several machines, treat signature freshness as an operational task separate from updating the Ubuntu package itself.

How do I run my first ClamAV scan?

Start with a path you intentionally choose. A one-time scan does not crawl the entire system unless you give it a broad path and the permissions needed to read that path.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Scan one file

clamscan /path/to/file

Replace the example path with the file you want to inspect. This is useful for a downloaded archive, an email attachment saved to disk, or a document copied from removable media.

Scan a directory and its subdirectories

clamscan -r /path/to/directory

The -r option requests recursive scanning, so ClamAV traverses files below the directory you specify. For a user’s home directory, you might run:

clamscan -r /home/your-user-name

Use the actual account directory rather than copying the example literally. Scanning a large home directory can take considerably longer than scanning one file because the command examines every readable item below the selected path.

Scan a mounted volume

Mount the volume through Ubuntu’s normal file manager or mount tools, identify its mount path, and pass that path to clamscan -r. Make sure your account can read the files. If the scan reports permission errors, rerun it with the privileges appropriate for that volume rather than granting broad permissions to all users.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter | 85W Max PD, 2 USB 3.0 & 1 USBC Data Ports, SD/TF Card Reader, for Laptops/Mac and Other Type C Devices (Charger Not Included)
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.

Read the result

ClamAV prints scan progress and a result for files it can inspect, followed by a summary. A clean result means the installed signatures did not identify a threat in the files that were actually scanned; it does not mean files outside the selected path were checked. Treat a detection as an item requiring investigation and isolation, and do not automatically delete an important file before you have confirmed what it is and whether it can be restored.

What is different about using the ClamAV daemon?

The daemon is intended for a persistent scanning process rather than a single command that starts and exits. Install clamav-daemon when another service or a recurring workflow needs that model; do not add it just to make a manual scan work.

After installing the daemon package, inspect its service state on your Ubuntu release:

systemctl status clamav-daemon

The command tells you whether the service is running and can reveal configuration or startup errors. It does not, by itself, configure an application to submit files to the daemon. A daemon deployment can require service-specific settings under /etc/clamav and a client or application that connects to it.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep the distinction clear:

  • clamscan is a straightforward command for a one-time scan with minimal setup.
  • clamd is a persistent process intended for a service-oriented arrangement.
  • Installing either package does not prove that every file operation on the desktop is being inspected.
  • Database updates remain necessary regardless of whether you scan with the command-line tool or the daemon.

How should I maintain an Ubuntu ClamAV installation?

There are two different maintenance jobs: updating the Ubuntu software package and updating the malware signature databases. Perform both when appropriate.

Update package files

sudo apt update
sudo apt upgrade

APT may update ClamAV along with other Ubuntu packages. The resulting version is determined by your configured release repositories and architecture.

Update signatures

sudo freshclam

Run FreshClam whenever you need current definitions and ensure that it completes successfully before a planned scan. Package upgrades and signature downloads are independent: upgrading the binary does not substitute for downloading the latest database files.

Recheck after a release change

When Ubuntu is upgraded to a different release, repeat apt policy clamav and confirm that the package candidate comes from the repositories you intend to use. Configuration files under /etc/clamav and service behavior can change with package revisions, so verify the daemon again if you use it.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What should I do if FreshClam reports a configuration problem?

Start with the package-managed configuration rather than deleting files or downloading a replacement configuration from an unknown source.

Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray | Data transfer & Fast charging for MacBook, iPhone 17/16/15, iPad, Samsung Galaxy, Apple Watch
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
  1. Confirm that the package is installed: apt policy clamav and, if relevant, apt policy clamav-daemon.
  2. Inspect the Ubuntu ClamAV configuration directory, /etc/clamav, for the FreshClam configuration supplied by the package.
  3. Read the exact error text and compare it with the settings in that directory. A malformed or conflicting local edit can prevent FreshClam from starting.
  4. After correcting the package configuration, run sudo freshclam again and verify that database files are downloaded or reported as current.

Service-managed installations can also involve a FreshClam process or timer. Check the installed package’s service and configuration behavior on the target Ubuntu release before changing ownership, schedules, or permissions.

Why does ClamAV say that databases are missing?

Because the scanner cannot work without its signature database files. ClamAV explicitly requires database files before the scanning engine starts, whether you use clamscan or clamd.

Run:

sudo freshclam

If the command cannot download anything, check network connectivity and the FreshClam error message. If it reports a configuration issue, inspect /etc/clamav as described above. Once FreshClam completes, rerun the scan command; installing the package alone does not retroactively create current definitions.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What if APT cannot find a ClamAV package candidate?

An error such as “no installation candidate” usually points to a repository, release, or architecture issue rather than a ClamAV command problem.

  • Run lsb_release -a and confirm that the system is the Ubuntu release you expect.
  • Run dpkg --print-architecture and verify that your configured repositories support that architecture.
  • Run sudo apt update and read any repository errors instead of ignoring them.
  • Use apt policy clamav to see whether APT knows about a candidate version.
  • Check the enabled package sources for the release. Package listings cover multiple Ubuntu suites, so a package available in one suite is not automatically available in another.

Do not force-install a package built for a different Ubuntu release merely to obtain a version number shown elsewhere. Resolve the repository and release mismatch first.

What if a scan fails because of permissions?

clamscan can only inspect files that the invoking account can read. A scan of your own home directory generally needs fewer privileges than a scan of system-owned directories or another user’s files.

First narrow the command to the path you actually need and confirm that the path exists. If the files are protected and you are authorized to inspect them, rerun the scan with the minimum elevated privileges required. Avoid changing file permissions globally just to make a scan complete; that can weaken the system you are trying to protect.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Does installing ClamAV enable real-time antivirus protection?

No automatic conclusion is safe. The command-line package is for scans you start, and installing the daemon does not by itself prove that a desktop file-monitoring layer is active. Check the daemon service state and the configuration of any application that is supposed to submit files to it.

For a manual workflow, think of ClamAV as a tool you invoke after downloading files, before opening an unknown archive, or when checking a selected directory. For continuous monitoring, plan and verify the complete daemon-based deployment instead of assuming that package installation supplied an always-on endpoint product.

Best Value
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

Can I remove the daemon or add it later?

Yes. The one-time scanner and the daemon are separate package choices. A minimal installation can begin with:

sudo apt install clamav

If your requirements change, add the daemon package with:

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo apt install clamav-daemon

Conversely, an administrator who no longer needs the persistent service can remove the daemon package while retaining the command-line scanner, subject to the dependencies APT reports. Review the proposed package changes before confirming removal.

What are the most common installation mistakes?

  • Scanning before updating definitions: the engine needs database files first. Run FreshClam before the first scan.
  • Assuming the daemon is required: one-off checks normally need only clamav.
  • Assuming installation created real-time protection: verify services and integrations on the target Ubuntu release.
  • Copying a package version from another system: Ubuntu package versions vary by release and architecture. Use APT’s candidate for your machine.
  • Scanning the wrong path: clamscan checks what you specify. Use -r for subdirectories and confirm the mount path of removable media.
  • Ignoring configuration errors: Ubuntu’s package-managed ClamAV settings are under /etc/clamav; inspect those files when FreshClam or the daemon fails.
  • Expecting a physical product or accessory: ClamAV is software installed from Ubuntu repositories, and its signatures are downloaded by FreshClam.

What is the safest basic workflow to remember?

For most Ubuntu users who want a manual malware check, the complete sequence is short:

  1. Refresh package metadata with sudo apt update.
  2. Install the scanner with sudo apt install clamav.
  3. Download current definitions with sudo freshclam.
  4. Scan a chosen file using clamscan /path/to/file, or a directory recursively using clamscan -r /path/to/directory.
  5. Review the reported results and investigate any detection before deleting or restoring files.

Add clamav-daemon only when a persistent service is part of your design, then inspect its status and configuration separately. This keeps a one-time scan simple while leaving room for a more managed deployment later.

Frequently Asked Questions

Are Ubuntu 22.04 and 24.04 the only releases that can run ClamAV?

No. They are the Ubuntu releases and architectures listed as regularly tested by the ClamAV project at the documented point in time. Other releases may package ClamAV as well, but you should verify availability and support through that release’s repositories rather than infer it from the tested-platform list.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Can I scan files while the ClamAV daemon package is installed?

Yes. Installing the daemon package does not remove the command-line scanner, so you can still invoke clamscan for a direct one-time check. Keep the signature database current regardless of which scanning path you use.

Does a successful FreshClam run guarantee that every Ubuntu file is protected?

No. FreshClam confirms that the local signature databases were downloaded or are current; it does not select scan paths or create desktop file monitoring. Protection still depends on the files you scan and, for continuous coverage, on a correctly configured service and integration.

Why is my ClamAV version different from a tutorial’s version?

Ubuntu repositories publish package revisions by release and architecture, so two valid systems can show different candidates. Use apt policy clamav on your machine and rely on the candidate offered by its configured repositories instead of matching a number from another tutorial.

Is ClamAV a replacement for every endpoint-security control on Ubuntu?

ClamAV provides the scanning engine and its signature databases, but the installation described here does not establish every endpoint-security feature. Decide separately how you will handle access control, updates, service monitoring, backups, and any real-time integrations your environment requires.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

ClamAVFreshClamLinux antivirusLinux securityUbuntu

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.