How to scan your server for malware with ClamAV

ClamAV is an open-source antivirus used to scan servers, especially those receiving files from users (uploads, email attachments).

1. Install

apt-get update -y
apt-get install -y clamav clamav-daemon

2. Update the signature database

systemctl stop clamav-freshclam
freshclam
systemctl start clamav-freshclam

3. Scan a directory

clamscan -r --infected /var/www

The -r option scans recursively, --infected shows only problematic files.

4. Schedule automatic scans

Add a daily scan to cron that quarantines infected files:

0 2 * * * clamscan -r --move=/var/quarantine /var/www

Tip

Scanning uses a lot of RAM and CPU. Run it at night, during low-traffic hours. Combine with regular backups, see the backup guides, so you can restore clean if you find an infection.