Read the entire article before executing any commands, and follow the commands in the order presented in the article, unless you know what you are doing.
This article, in addition to installing and configuring ClamAV, serves educational purposes for learning.
This is an explanatory article for the purpose of understanding ClamAV, and it has been tested multiple times for the intended purpose of the article.
Someone might say, "Why would you need an antivirus on Linux?"; However, viruses for Linux do exist, but since Linux isn't widely used as a desktop, nobody makes viruses specifically for it. Furthermore, with the advent of AI, some extra protection is necessary on desktops and, especially, on servers.
ClamAV is an open-source (GPLv2) antivirus toolkit designed specifically for email scanning on email servers. It provides several utilities including a flexible and scalable multi-threaded daemon, a command-line scanner, and an advanced tool for automatic database updates. The core of the package is an antivirus engine available as a shared library.
ClamAV® is a powerful open-source antivirus engine for detecting Trojans, viruses, malware, and other malicious threats. ClamAV does not have a "quick scan" mode. ClamAV is a malware detection toolset, not a traditional antivirus or endpoint security suite.
It's up to you to decide what to scan. A full system scan will take a long time with ClamAV or any other antivirus software.
Clamscan, ClamOnAcc, and Clamdscan include the "--remove" option to delete any file that generates alerts during a scan. This is generally a very bad idea unless you are monitoring an uploads/downloads directory. False positives happen! You don't want the wrong file to be accidentally deleted. Instead, consider using the "--move" parameter or perhaps just "--copy" and set up a script with the "VirusEvent" feature to notify you when something is detected.
ClamAV includes an email filtering tool called clamav-milter. This tool interacts directly with Clamd, and therefore requires a running Clamd instance to operate. However, the configuration and log files for clamav-milter are separate from those of Clamd.
NOTICE
ClamAV comes minimally configured; you must configure it manually according to your scenario and needs. If you are one of those greasy, smelly souls who like to say, "No way am I going to go through all this trouble to configure a program," stop reading this article here and go bang your head against the wall, or stick your face in a fan repeatedly, or go do whatever you like to do, but clearly, your place is not here.
At the end there is a summary with the commands and little explanation.
ClamAV is provided by Cisco Systems, Inc.
Documentation:
The distribution used as an example was Void, however, you can adapt it to your own distribution without major changes.
ClamAV is present in the repositories of almost all distributions.
Several of the commands used are universal across almost all distributions.
Installation for Fedora, AlmaLinux, openSUSE, etc.:
Installation for Debian, Ubuntu, Mint, etc.:
To install from source:
Checking the Kernel configuration
for the presence of fanotify:
If enabled in the Kernel, the output will be this:
What if this appears:
So it's enabled, but access verification will be restricted to notification-only mode, meaning it will warn you about viruses but will do absolutely nothing.
If you see "CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set," fanotify is not enabled in your kernel, so you will need to recompile the kernel to enable it or install a more modern kernel, but this will not be shown here as it is time-consuming and outside the scope of this article.
It's unlikely you'll get "CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set" because "CONFIG_FANOTIFY=y" is enabled by default in the x86 architecture in Linux Kernel version 2.6.37, and "CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y" is enabled by default in the generic x86 defconfig in Linux Kernel version 3.14.
The configuration of the clamav-milter.conf file will not be modified; we will leave it with the default settings. ClamAV-Milter is the ClamAV application that provides email filtering; it's not necessary if the Linux machine is not an email server. For desktops, installation is not required, but it's a matter of preference.
CONFIG_FANOTIFY=y
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
What if this appears:
CONFIG_FANOTIFY=y
# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set
# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set
So it's enabled, but access verification will be restricted to notification-only mode, meaning it will warn you about viruses but will do absolutely nothing.
If you see "CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set," fanotify is not enabled in your kernel, so you will need to recompile the kernel to enable it or install a more modern kernel, but this will not be shown here as it is time-consuming and outside the scope of this article.
It's unlikely you'll get "CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set" because "CONFIG_FANOTIFY=y" is enabled by default in the x86 architecture in Linux Kernel version 2.6.37, and "CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y" is enabled by default in the generic x86 defconfig in Linux Kernel version 3.14.
The configuration of the clamav-milter.conf file will not be modified; we will leave it with the default settings. ClamAV-Milter is the ClamAV application that provides email filtering; it's not necessary if the Linux machine is not an email server. For desktops, installation is not required, but it's a matter of preference.
Updating and installing (adapt to your distribution): Name Action Version New version Download size
clamav install - 1.5.3_1 40MB
Size to download: 40MB
Size required on disk: 182MB
Space available on disk: 5405MB
Do you want to continue? [Y/n] Y
[*] Downloading packages
clamav-1.5.3_1.x86_64.xbps.sig2: 512B [avg rate: 14MB/s]
clamav-1.5.3_1.x86_64.xbps: 40MB [avg rate: 9318KB/s]
clamav-1.5.3_1: verifying RSA signature...
[*] Collecting package files
clamav-1.5.3_1: collecting files...
[*] Unpacking packages
clamav-1.5.3_1: unpacking ...
[*] Configuring unpacked packages
clamav-1.5.3_1: configuring ...
Created _clamav system group.
Created _clamav system user.
clamav-1.5.3_1: installed successfully.
1 downloaded, 1 installed, 0 updated, 1 configured, 0 removed, 0 on hold.
The files will be created in the /etc directory:
/etc/freshclam.conf
/etc/clamd.conf
/etc/clamav-milter.conf.sample
Note: In some distributions, it will be located in the path
/etc/clamav; verify the correct path.
/etc/clamd.conf
/etc/clamav-milter.conf.sample
Suggested search: If you already have files from a previous installation and did not want to remove them to preserve your settings, the installation preserves the files and creates new ones with the following naming convention:
/etc/freshclam.conf.new-1.5.3_1
/etc/clamd.conf.new-1.5.3_1
/etc/clamav-milter.conf.sample
If you wish, you can remove them.
/etc/clamd.conf.new-1.5.3_1
/etc/clamav-milter.conf.sample
Verify that the ClamAV user and group have been created:
If it hasn't already been created in your distribution, create the user (in Void, when installing ClamAV, the _clamav user and group are created automatically, so you can skip these two commands): If your operating system does not have the groupadd and useradd utilities, install them.
Let's remove the file extension:
If needed, here is the official freshclam.conf file:
Creating a directory for the local socket and setting permissions (verify the correct username): For standardization purposes, the underscore is omitted in /var/run/clamav.
Log files
for Freshclam:
For Clamd:
Setting the database directory to the correct owner (check if it's
_clamav or clamav):
https://github.com/Cisco-Talos/clamav/blob/main/etc/freshclam.conf.sample
Creating a directory for the local socket and setting permissions (verify the correct username): For standardization purposes, the underscore is omitted in /var/run/clamav.
for Freshclam:
The ClamAV Daemon, or Clamd, is a multithreaded daemon that uses libclamav to scan files for viruses. ClamAV provides several tools that interact with this daemon.
These include:
- Clamdscan - a simple scanning client;
- Clamonacc - provides real-time scanning (also known as real-time protection via a Clamd instance);
- Clamav-milte r - an email filtering plugin for the Sendmail email processing server software, which allows you to analyze emails;
- Clamdtop - a resource monitoring interface for Clamd.
ClamAV also provides a command-line tool for simple scanning tasks using libclamav, called Clamscan. Unlike the Clamd daemon, Clamscan is not a persistent process and is better suited for use cases where a single scan with minimal configuration is required.
The more complex tools provided by ClamAV require some degree of configuration. ClamAV provides three files with example configurations:
🔵clamd.conf: to configure the behavior of the ClamAV Daemon and associated tools;🟢freshclam.conf: to configure the behavior of the signature database update tool;🟡clamav-milter.conf: to configure ClamAV's email filtering behavior for the email server, which interacts directly with Clamd.
In addition, a tool called clamconf allows users to
verify the settings used by each of the other tools, obtaining
information from the configuration files listed above, along with
other relevant information.
Clamconf displays all configurations:
Depending on the installation method and operating
system, some configuration options may already be pre-configured. In
Void, all configuration files are commented out, except for the User
line in the clamd.conf file.
However, depending on the distribution, you may need
to create new configuration files or modify existing ones with
custom settings that make more sense for your use case.
For your information, an installation from source
code will require you to create a freshclam.conf file before
using Freshclam, a "clamd.conf" file before using Clamd, and a
"clamav-milter.conf" file before using ClamAV-Milter.
The files freshclam.conf, clamd.conf, and
clamav-milter.conf are the main configuration files for ClamAV
antivirus.
The parameter "DatabaseDirectory /var/lib/_clamav"
must be the same in both the freshclam.conf and clamd.conf
files. If you change it in one, you must also change it in the
other. I advise leaving it as the default.
In some distributions it is /var/lib/clamav,
without the underscore.
NOTICE
"The mirrors and links reserve the right to block
your IP address if you abuse downloads and updates too
frequently per hour or abuse the server in any way."
Update your databases and subscriptions
wisely.
The Freshclam tool is used to download and update
the official ClamAV virus signature databases.
Note: On systems where SELinux is enabled, you
will likely need to define the correct SELinux context;
otherwise, the Freshclam service will not be able to access the
file.
Below are the contents of the freshclam.conf and
clamd.conf files, both in a functional state and with mirrors to
virus and malware databases in general.
Freshclam
is the automatic database update tool for Clam AntiVirus.
It can be configured to work in two modes:
- Interactive - on-demand from the command line;
- daemon - silently in the background.
Here we will make it interactive using Cron.
FRESHCLAM.CONF
I use vim, use your preferred editor. Comment out or remove line ~8:
# Comment or remove the line below.
# Example ... <<< Line 8
# Example ... <<< Line 8
Uncomment and configure the parameters below (or leave everything commented out and add it at the end).
Note: On line 92, comment out "DatabaseMirror database.clamav.net", as it is already below. Save and exit.
CLAMD.CONF
Comment out or remove line ~8:
To test: Exit: 104857600
Permanent:
Output: fs.inotify.max_user_watches=104857600
# Comment or remove the line below.
# Example ... <<< Line 8
# Example ... <<< Line 8
Uncomment and configure the parameters below (or
leave everything commented out and add them at the end).
Note: Be sure to check if the ClamAV user in your
distribution is clamav or _clamav and change it below in the
User line. And in place of "your_username" put your username
(OnAccessIncludePath /home/your_username/Downloads).
Check line 269 (User _clamav) and comment it out if you are
adding everything below.
Save and exit.
Note: If you decide to enable Clamonacc later, I
advise against enabling
#OnAccessIncludePath /home
and
#OnAccessIncludePath /home/username
because it may cause freezes when opening these folders
graphically (by clicking with the mouse), and it may happen that
when opening the user folder, the folder and file icons
disappear, giving the impression that everything has been
deleted. If this happens, simply disable Clamonacc (sudo sv stop
clamonacc). Clamonacc (Real-Time Protection) exerts a very large
amount of control over the configured directories and
files.
Inotify has a limited number of control points
available for use by a process at any given time. To increase
the number of
inotifywatch-points
available for use by ClamAV, run:
To test: Exit: 104857600
Permanent:
Output: fs.inotify.max_user_watches=104857600
NOTICE
The number there is 100M converted to bytes. This
number must be the same as the OnAccessMaxFileSize parameter. If
you change the number in the OnAccessMaxFileSize parameter, you
must run this command again with the new number.
ClamAV doesn't have a quarantine file by default, so let's create and configure one.
Creating directory and file and setting permissions:
Disabling File Execution (Secure Mount)
The biggest threat from a quarantine is a user or
script accidentally executing an infected binary that's inside
it.
The most robust way to prevent this in
Linux
is to isolate the directory in a separate mount (or using a loop
device) with the
noexec
flag .
Let's apply a "bind mount" to
/etc/fstab.
Add the following line at the end to apply strict
security restrictions (
noexec , nosuid
, and
nodev
prevent the execution of programs, SUID binaries, and the creation
of devices):
...
/var/opt/clamav-quarantena /var/opt/clamav-quarantena none bind,noexec,nosuid,nodev 0 0
/var/opt/clamav-quarantena /var/opt/clamav-quarantena none bind,noexec,nosuid,nodev 0 0
Assembling immediately:
Creating a cleanup script that preserves the
quarantine.log and logrotate files and cleans up the others:
Place inside:
Save and exit.
Granting permissions:
This warning script is just an example; it's up to you to adapt it to your email provider and settings, as this is not the scope of the article.
The lines:
EMAIL_DESTINO
and the subject line =
until
) | msmtp
are commented out for testing purposes without needing to configure email sending; it will only display the warning popup on the screen, which will remain until you click on it.
Permissioning: Let's test this by creating a "suspicious" file inside the quarantine directory: Reset the state file to ZERO to force the alert: Running the script manually:
And we see the warning message with Zenity.
We see the alert message with Notify-send and XFCE.
Alert message with Cinnamon and Notify-send.
I prefer Notify-send because it stays on the
screen until you click on the notification and doesn't minimize
if you click outside of it, like Zenity does.
If you want Zenity, install it: See also: Output: 2026-09-18 11:14:53 -> ALERT: 1 new isolated file(s): test.txt
Deleting the file: Checking if everything remained the same: total 4
drwx------ 1 _clamav _clamav 54 Sep 23 09:05 .
drwxr-xr-x 1 root root 34 Sep 23 09:02 ..
-rw-r--r-- 1 _clamav _clamav 2 Sep 23 09:10 .ultimo_total
-rw-r--r-- 1 _clamav _clamav 0 Sep 23 09:02 quarantine.log
There must be 4 files and this is the only one that should be in root:
drwxr-xr-x 1 root root 34 21 09:02 ..
The others must be owned by the user _clamav.
If ClamAV detects malware in a scan and moves it to quarantine, these files may be owned by another user, however, the 4 basic files must be in this format.
To see the last 10 lines when the file is larger: In XFCE, if you want to enhance the alert layout with notify-send, run: And then restart:
At the terminal:
Creating a quarantine log file
Save and exit.
The others must be owned by the user _clamav.
If ClamAV detects malware in a scan and moves it to quarantine, these files may be owned by another user, however, the 4 basic files must be in this format.
To see the last 10 lines when the file is larger: In XFCE, if you want to enhance the alert layout with notify-send, run: And then restart:
There are few options, but the advantage is that
the alert stays on the screen until you click on it.
With Zenity, the alert allows for a better layout,
but clicking outside of it minimizes it, and you might forget,
turn off the machine, and not check your email or log.
It's up to you to choose the best option for your
taste: notify-send or zenity.
In
Cinnamon
, the path is: Menu > System Settings > in the
"Preferences" section, click on Notifications.
This file is located in the
/etc/clamd.conf
settings (
VirusEvent /usr/local/bin/notify-virus.sh
).
Since the periodic script
/usr/local/bin/monitor-quarentena.sh
configured in Cron reads the number of files in the folder and
compares it with the previous state (
.ultimo_total
), it will also notice that a new file has arrived (moved by
Clamonacc) and will trigger the alert if the number
changes.
Creating the LOGROTATE
Installing: Creating the file: Place inside: Save and exit.
This way the file won't get too big.
Checking:
warning: logrotate in debug mode does nothing except printing debug messages! Consider using verbose mode (-v) instead if this is not what you want. reading config file /etc/logrotate.d/clamav-quarentena Reading state from file: /var/lib/logrotate.status Allocating hash table for state file, size 64 entries Creating new state Creating new state Creating new state Handling 1 logs rotating pattern: /var/opt/clamav-quarentena/quarentena.log monthly empty log files are not rotated, (6 rotations), old logs are removed switching euid from 0 to 989 and egid from 0 to 988 (pid 10363) considering log /var/opt/clamav-quarantena/quarentena.log Creating new state Now: 2026-09-23 22:35 Last rotated at 2026-09-23 22:00 log does not need rotating (log has already been rotated) switching euid from 989 to 0 and egid from 988 to 0 (pid 10363)The output indicates that everything is correct.
Creating logrotate for Freshclam and Clamd: Place inside: Checking:
Parameters
- Monthly : The log file will be rotated once a month (usually on the first day of the month).
- Rotate 6: The system will maintain a maximum of 6 old log files. When the 7th month arrives, the oldest log will be permanently deleted.
- compress : Compresses old logs into the .gz format to save disk space.
- delaycompress : Delays the compression of the previous log to the next rotation cycle. In practice, the current month's log will be active, last month's log will be rotated but in plain text (.1), and only the month before last will be compressed (.2.gz, .3.gz). This is useful if some program still needs to write or read the log immediately after the rollover.
- missingok : If the quarantine.log file does not exist for some reason (eg, it was manually deleted), logrotate will not generate any error and will proceed to the next service silently.
- notifempty : Do not rotate the log if it is empty. If ClamAV has not detected any threats in the month and the file is 0 bytes, logrotate skips the cycle and saves processing power.
- create 0640 _clamav _clamav : Immediately after rotating (moving) the old file, logrotate creates a brand new quarantine.log file with permissions 0640 (read/write for the owner, read for the group) and sets the owner as user _clamav and group _clamav.
- sharedscripts : Ensures that the postrotate block (the reload commands) is executed only once at the end, instead of firing once for each file.
- vsv reload : In Void Linux, the vsv (or sv reload) utility sends a controlled HUP signal to runit. This forces ClamAV and Freshclam to close the old file descriptor and start writing to the new, zeroed file that create 0640 just generated.
We now need to update the database, which may take a
few minutes.
Depending on how you installed it and the version of
ClamAV you are using, you may encounter errors the first time you
run
Freshclam .
When Freshclam is run, the program will attempt to
retrieve an update from the address specified in the
DatabaseMirror
line ; if it doesn't find one, it will move to the next address
until it finds and downloads the updates. After that, it will
execute all
DatabaseCustomURLs .
However, first we need to run the command that enables
the Clamd service and integrates it with runit, so it will start
along with the system:
Trying to start Clamd:
Exit:
timeout: down: clamd: 0s, normally up, want up
Wed Sep 23 22:44:45 2026 -> Database test passed.
Wed Sep 23 22:44:45 2026 -> doppelstern.ndb updated (version: custom database, sigs: 1)
Wed Sep 23 22:44:45 2026 -> fc_download_url_database: doppelstern.ndb updated.
Wed Sep 23 22:44:45 2026 -> Database update completed successfully.
Wed Sep 23 22:44:45 2026 -> Clamd successfully notified about the update.
It will probably crash because it's a bug where, even
if Clamd doesn't start, it's necessary to run the command before
updating the database to avoid the WARNING that Clamd wasn't
notified.
To run Freshclam correctly, always execute it by
invoking the ClamAV user:
or
...Wed Sep 23 22:44:45 2026 -> Database test passed.
Wed Sep 23 22:44:45 2026 -> doppelstern.ndb updated (version: custom database, sigs: 1)
Wed Sep 23 22:44:45 2026 -> fc_download_url_database: doppelstern.ndb updated.
Wed Sep 23 22:44:45 2026 -> Database update completed successfully.
Wed Sep 23 22:44:45 2026 -> Clamd successfully notified about the update.
It will finish without errors with these last lines
above.
If a WARNING like this appears at the end:
If a WARNING like this appears at the end:
WARNING: Wed Sep 16 12:02:53 2026 -> Clamd was NOT notified:
Can't connect to Clamd through /var/run/clamav/clamd.ctl: No such
file or directory
. Don't worry, Clamd still needs to be started.
If you get an error, check what the error is and fix it. For example:
If a WARNING like this appears at the end:
. Don't worry, Clamd still needs to be started.
If you get an error, check what the error is and fix it. For example:
ERROR: Fri Sep 4 15:48:00 2026 -> NotifyClamd: No communication
socket specified in /etc/clamd.conf
ERROR: Fri Sep 4 15:48:00 2026 -> Can't send to clamd: Socket operation on non-socket
This error means that some configuration in the /etc/clamd.conf
file is incorrect.
ERROR: Fri Sep 4 15:48:00 2026 -> Can't send to clamd: Socket operation on non-socket
If a WARNING like this appears at the end:
WARNING: Tue Sep 8 09:56:06 2026 -> Clamd was NOT notified:
Can't connect to Clamd through /var/run/clamav/clamd.ctl: Permission
denied
check these lines:
https://docs.clamav.net/faq/faq-freshclam.html
Or copy and paste the command containing the error and search it on Google or into an AI.
check these lines:
LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup clamav
LocalSocketMode 666
FixStaleSocket true
LocalSocketGroup clamav
LocalSocketMode 666
Then run the command
`sudo -u _clamav freshclam`
(or
`sudo -u clamav freshclam`
) again. And, if the lines are correct, don't worry: this
warning will disappear when you start Clamd.
For other errors, see this link which addresses
most errors when running Freshclam for the first time:
https://docs.clamav.net/faq/faq-freshclam.html
Or copy and paste the command containing the error and search it on Google or into an AI.
Starting the CLAMD Service in Void
ok: run: clamd: (pid 21883) 34s
If you want, you can run it again:
Then you can always check with: run: clamd: (pid 19534) 3s; run: log: (pid 18660) 259s
If you want, you can run it again:
Then you can always check with: run: clamd: (pid 19534) 3s; run: log: (pid 18660) 259s
Checking with Htop.
$ sudo htop
Checking with ClamdTop.
$ sudo clamdtop
For other systems, see:
https://www.vivaolinux.com.br/artigo/Antivirus-ClamAV-com-protecao-em-tempo-real/
https://www.vivaolinux.com.br/artigo/ClamAV-o-kit-de-ferramentas-antivirus/
Looking at the last 10 lines to check if the logs are working:
Mon Sep 21 09:22:18 2026 -> download_complete_callback:
fc_context->bTestDatabases : 1
Mon Sep 21 09:22:18 2026 -> download_complete_callback: fc_context->bBytecodeEnabled : 1
Mon Sep 21 09:22:18 2026 -> Testing database: '/var/lib/_clamav/tmp.9f45e86cf8/clamav-4821cfa51c2c06a78e61b54f2a22520a.tmp-doppelstern.ndb' ...
Mon Sep 21 09:22:18 2026 -> Loading signatures from /var/lib/_clamav/tmp.9f45e86cf8/clamav-4821cfa51c2c06a78e61b54f2a22520a.tmp-doppelstern.ndb
Mon Sep 21 09:22:18 2026 -> Properly loaded 1 signatures from /var/lib/_clamav/tmp.9f45e86cf8/clamav-4821cfa51c2c06a78e61b54f2a22520a.tmp-doppelstern.ndb
Mon Sep 21 09:22:18 2026 -> Database test passed.
Mon Sep 21 09:22:18 2026 -> doppelstern.ndb updated (version: custom database, sigs: 1)
Mon Sep 21 09:22:18 2026 -> fc_download_url_database: doppelstern.ndb updated.
Mon Sep 21 09:22:18 2026 -> Database update completed successfully.
Mon Sep 21 09:22:18 2026 -> Clamd successfully notified about the update.
Mon Sep 21 09:22:18 2026 -> download_complete_callback: fc_context->bBytecodeEnabled : 1
Mon Sep 21 09:22:18 2026 -> Testing database: '/var/lib/_clamav/tmp.9f45e86cf8/clamav-4821cfa51c2c06a78e61b54f2a22520a.tmp-doppelstern.ndb' ...
Mon Sep 21 09:22:18 2026 -> Loading signatures from /var/lib/_clamav/tmp.9f45e86cf8/clamav-4821cfa51c2c06a78e61b54f2a22520a.tmp-doppelstern.ndb
Mon Sep 21 09:22:18 2026 -> Properly loaded 1 signatures from /var/lib/_clamav/tmp.9f45e86cf8/clamav-4821cfa51c2c06a78e61b54f2a22520a.tmp-doppelstern.ndb
Mon Sep 21 09:22:18 2026 -> Database test passed.
Mon Sep 21 09:22:18 2026 -> doppelstern.ndb updated (version: custom database, sigs: 1)
Mon Sep 21 09:22:18 2026 -> fc_download_url_database: doppelstern.ndb updated.
Mon Sep 21 09:22:18 2026 -> Database update completed successfully.
Mon Sep 21 09:22:18 2026 -> Clamd successfully notified about the update.
Mon Sep 21 09:39:28 2026 -> ELF support enabled.
Mon Sep 21 09:39:28 2026 -> Mail files support enabled.
Mon Sep 21 09:39:28 2026 -> OLE2 support enabled.
Mon Sep 21 09:39:28 2026 -> PDF support enabled.
Mon Sep 21 09:39:28 2026 -> SWF support enabled.
Mon Sep 21 09:39:28 2026 -> HTML support enabled.
Mon Sep 21 09:39:28 2026 -> XMLDOCS support enabled.
Mon Sep 21 09:39:28 2026 -> HWP3 support enabled.
Mon Sep 21 09:39:28 2026 -> OneNote support enabled.
Mon Sep 21 09:39:28 2026 -> Self checking every 3600 seconds.
Mon Sep 21 09:39:28 2026 -> Mail files support enabled.
Mon Sep 21 09:39:28 2026 -> OLE2 support enabled.
Mon Sep 21 09:39:28 2026 -> PDF support enabled.
Mon Sep 21 09:39:28 2026 -> SWF support enabled.
Mon Sep 21 09:39:28 2026 -> HTML support enabled.
Mon Sep 21 09:39:28 2026 -> XMLDOCS support enabled.
Mon Sep 21 09:39:28 2026 -> HWP3 support enabled.
Mon Sep 21 09:39:28 2026 -> OneNote support enabled.
Mon Sep 21 09:39:28 2026 -> Self checking every 3600 seconds.
To view in real time:
Mon Sep 21 09:39:28 2026 -> ELF support enabled.
Mon Sep 21 09:39:28 2026 -> Mail files support enabled.
Mon Sep 21 09:39:28 2026 -> OLE2 support enabled.
Mon Sep 21 09:39:28 2026 -> PDF support enabled.
Mon Sep 21 09:39:28 2026 -> SWF support enabled.
Mon Sep 21 09:39:28 2026 -> HTML support enabled.
Mon Sep 21 09:39:28 2026 -> XMLDOCS support enabled.
Mon Sep 21 09:39:28 2026 -> HWP3 support enabled.
Mon Sep 21 09:39:28 2026 -> OneNote support enabled.
Mon Sep 21 09:39:28 2026 -> Self checking every 3600 seconds.
Mon Sep 21 09:39:28 2026 -> Mail files support enabled.
Mon Sep 21 09:39:28 2026 -> OLE2 support enabled.
Mon Sep 21 09:39:28 2026 -> PDF support enabled.
Mon Sep 21 09:39:28 2026 -> SWF support enabled.
Mon Sep 21 09:39:28 2026 -> HTML support enabled.
Mon Sep 21 09:39:28 2026 -> XMLDOCS support enabled.
Mon Sep 21 09:39:28 2026 -> HWP3 support enabled.
Mon Sep 21 09:39:28 2026 -> OneNote support enabled.
Mon Sep 21 09:39:28 2026 -> Self checking every 3600 seconds.
Press Ctrl+C to exit.
Verify that clamd.ctl was created in /var/run/clamav:
total 0
drwxr-x--- 2 _clamav _clamav 60 Sep 23 22:36 .
drwxr-xr-x 23 root root 620 Sep 23 22:07 ..
srw-rw---- 1 _clamav _clamav 0 Sep 23 22:36 clamd.ctl
drwxr-x--- 2 _clamav _clamav 60 Sep 23 22:36 .
drwxr-xr-x 23 root root 620 Sep 23 22:07 ..
srw-rw---- 1 _clamav _clamav 0 Sep 23 22:36 clamd.ctl
Now let's enable Clamonacc, also known as
Real-Time Protection .
ClamAV doesn't have the kind of protection that constantly scans the computer; it only scans the directory and/or file when it's accessed. The Clamonacc client for the Clamd scanning daemon provides access-on-access scanning in modern Linux versions , including an optional feature to block file access until it's verified.
ClamAV doesn't have the kind of protection that constantly scans the computer; it only scans the directory and/or file when it's accessed. The Clamonacc client for the Clamd scanning daemon provides access-on-access scanning in modern Linux versions , including an optional feature to block file access until it's verified.
IMPORTANT:
If fanotify is not enabled in the kernel, there is no point in performing this procedure without enabling it first.
To configure Clamonacc, simply adjust the /etc/clamd.conf file.
Since the settings are already in the file, here are the basic
steps:
Creating Clamonacc in Void
Place inside:
Save and exit.
ok: run: clamonacc: (pid 12570) 7s
ok: run: clamonacc: (pid 12716) 1s
run: clamonacc: (pid 12716) 42s
To verify better, you can use htop:
- Open the file /etc/clamd.conf;
- Specify the path(s) you would like to monitor by setting the OnAccessIncludePath option;
- Set OnAccessPrevention to yes;
- Check which username is being used to run the command, clamav or _clamav;
- Set OnAccessExcludeUname to the corresponding username;
- Save your work and close clamd.conf.
ok: run: clamonacc: (pid 12716) 1s
run: clamonacc: (pid 12716) 42s
To verify better, you can use htop:
htop
The global standard for testing antivirus software
without using actual malicious code is the EICAR Standard
Anti-Virus Test File. Any up-to-date antivirus, including
ClamAV, will immediately identify it as a threat named
Win.Test.EICAR_HBR-1 or similar.
ClamAV return codes: 0 = clean, 1 = infected, 2 = error.
Add the OnAccessIncludePath /home/your_username/Downloads option to the file:
##OnAccessIncludePath /home
##OnAccessIncludePath /home/your_user
OnAccessIncludePath /home/your_user/Downloads
##OnAccessIncludePath /home/your_user
OnAccessIncludePath /home/your_user/Downloads
Restart the services: ok: run: clamd: (pid 15652) 0s
ok: run: clamonacc: (pid 15702) 1s
Trying to create the file: bash: /home/user/Downloads/eicar.com: Operation not permitted
This must be happening because in the
/etc/clamd.conf file
, the path
/home/your_username/Downloads
is in the
OnAccessIncludePath
.
IMPORTANT NOTICE
In some graphical interfaces, such as Cinnamon,
there will be no warning in the terminal, but the protection is
working. After echoing, simply check the ~/Downloads folder and
see that the file is not there, and check the
/var/opt/clamav-quarantine directory.
We'll do it with sudo:
Attempting to read the file:
cat: /home/usuario/Downloads/eicar.com: Operation not permitted.
In XFCE, Clamonacc prevents access to the file and then moves it to quarantine. cat: /home/kluster/Downloads/eicar.com: File or directory does not exist
In Cinnamon, the file is moved to quarantine
before any process can even read it.
The different behavior occurs because
Cinnamon
and
XFCE
handle system errors originating from kernel calls and user
notifications in distinct ways.
When we use the
echo command
,
bash
can temporarily create the file in memory, but in the next
millisecond, Cinnamon's indexer tries to read the file to
generate an ID/thumbnail. This triggers ClamAV, which blocks
access and moves the file immediately.
ClamAV return codes: 0 = clean, 1 = infected, 2 = error
We'll try using sudo:
cat: /home/user/Downloads/eicar.com: File or directory does not exist
Note that the file was moved to quarantine because
we added
the option
--move=/var/opt/clamav-quarentena to the /
etc/sc/clamonacc/run file
, and it was logged because we added
the option
VirusEvent /usr/local/bin/notificar-virus.sh to the
/etc/clamd.conf file
.
total 12
drwx------ 1 _clamav _clamav 160 Sep 21 09:51 .
drwxr-xr-x 1 root root 34 Sep 21 09:02 ..
-rw------- 1 root root 0 Sep 21 09:45 .clamav-quarantine-lock.12718.0
-rw-r--r-- 1 _clamav _clamav 2 Sep 21 09:50 .ultimo_total
-rw------- 1 root root 69 Sep 14 15:55 eicar.com
-rw------- 1 root root 69 Sep 21 09:48 eicar.com.001
-rw-r--r-- 1 _clamav _clamav 0 Sep 21 09:02 quarantine.log
drwx------ 1 _clamav _clamav 160 Sep 21 09:51 .
drwxr-xr-x 1 root root 34 Sep 21 09:02 ..
-rw------- 1 root root 0 Sep 21 09:45 .clamav-quarantine-lock.12718.0
-rw-r--r-- 1 _clamav _clamav 2 Sep 21 09:50 .ultimo_total
-rw------- 1 root root 69 Sep 14 15:55 eicar.com
-rw------- 1 root root 69 Sep 21 09:48 eicar.com.001
-rw-r--r-- 1 _clamav _clamav 0 Sep 21 09:02 quarantine.log
The file eicar.com.001 is a control file that ClamAV creates automatically.
Testing again with sudo in both commands: cat: /home/usuario/Downloads/eicar.com: Operation not permitted
cat: /home/user/Downloads/eicar.com: File or directory does not exist
total 16
drwx------ 1 _clamav _clamav 186 Sep 21 09:58 .
drwxr-xr-x 1 root root 34 Sep 21 09:02 ..
-rw------- 1 root root 0 Sep 21 09:45 .clamav-quarantine-lock.12718.0
-rw-r--r-- 1 _clamav _clamav 2 Sep 21 09:56 .ultimo_total
-rw------- 1 root root 69 Sep 14 15:55 eicar.com
-rw------- 1 root root 69 Sep 21 09:48 eicar.com.001
-rw------- 1 root root 69 Sep 21 09:57 eicar.com.002
-rw-r--r-- 1 _clamav _clamav 0 Sep 21 09:02 quarantine.log
drwx------ 1 _clamav _clamav 186 Sep 21 09:58 .
drwxr-xr-x 1 root root 34 Sep 21 09:02 ..
-rw------- 1 root root 0 Sep 21 09:45 .clamav-quarantine-lock.12718.0
-rw-r--r-- 1 _clamav _clamav 2 Sep 21 09:56 .ultimo_total
-rw------- 1 root root 69 Sep 14 15:55 eicar.com
-rw------- 1 root root 69 Sep 21 09:48 eicar.com.001
-rw------- 1 root root 69 Sep 21 09:57 eicar.com.002
-rw-r--r-- 1 _clamav _clamav 0 Sep 21 09:02 quarantine.log
2026-09-21 09:03:32 -> REAL-TIME ALERT: Suspicious file
'/home/your_username/Downloads/eicar.com' detected and isolated
(Virus: {HEX}test.test.eicar.1040.UNOFFICIAL)
Testing Scanning:
Remember that Clamscan doesn't use a configuration file, but its own parameters in the binary; however, we'll soon create a wrapper for it, as we'll be using it for scans with cron.
Clamdscan uses the parameters from the /etc/clamd.conf file for scans, as does Clamonacc for protection.
Let's comment out
the /home/your_username/Downloads directory in the file: https://docs.clamav.net/manual/Usage/Scanning.html#clamdscan Comment:
Save and exit. ok: run: clamd: (pid 31196) 0s
ok: run: clamonacc: (pid 31276) 0s
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Testing
https://sanesecurity.com/foxhole-databases/
Remember that Clamscan doesn't use a configuration file, but its own parameters in the binary; however, we'll soon create a wrapper for it, as we'll be using it for scans with cron.
Loading: 6s, ETA: 0s [========================>] 3.80M/3.80M
sigs
Compiling: 2s, ETA: 0s [========================>] 42/42 tasks
/home/seu_usuario/Downloads/grub-void.html: OK
/home/seu_usuario/Downloads/vkpurge.html: OK
/home/seu_usuario/Downloads/zram-zswap.mhtml: OK
/home/seu_usuario/Downloads/linux-7.1.2.tar.xz: OK
/home/seu_usuario/Downloads/apache-netbeans.svg: OK
/home/seu_usuario/Downloads/wgcf-master.zip: OK
/home/your_usuario/Downloads/wgcf-account.toml: OK
----------- SCAN SUMMARY -----------
Known viruses: 3797093
Engine version: 1.5.3
Scanned directories: 1
Scanned files: 7
Infected files: 0
Data scanned: 16.27 MiB
Data read: 159.41 MiB (ratio 0.10:1)
Time: 19.103 sec (0 m 19 s)
Start Date: 2026:09:23 23:41:10
End Date: 2026:09:23 23:41:29
Compiling: 2s, ETA: 0s [========================>] 42/42 tasks
/home/seu_usuario/Downloads/grub-void.html: OK
/home/seu_usuario/Downloads/vkpurge.html: OK
/home/seu_usuario/Downloads/zram-zswap.mhtml: OK
/home/seu_usuario/Downloads/linux-7.1.2.tar.xz: OK
/home/seu_usuario/Downloads/apache-netbeans.svg: OK
/home/seu_usuario/Downloads/wgcf-master.zip: OK
/home/your_usuario/Downloads/wgcf-account.toml: OK
----------- SCAN SUMMARY -----------
Known viruses: 3797093
Engine version: 1.5.3
Scanned directories: 1
Scanned files: 7
Infected files: 0
Data scanned: 16.27 MiB
Data read: 159.41 MiB (ratio 0.10:1)
Time: 19.103 sec (0 m 19 s)
Start Date: 2026:09:23 23:41:10
End Date: 2026:09:23 23:41:29
Loading: 10s, ETA: 0s [========================>] 3.80M/3.80M
sigs
Compiling: 2s, ETA: 0s [=======================>] 42/42 tasks
WARNING: Can't open file /home/usuario/Downloads/eicar.com: Operation not permitted
----------- SCAN SUMMARY -----------
Known viruses: 3796968
Engine version: 1.5.3
Scanned directories: 0
Scanned files: 0
Infected files: 0
Total errors: 1
Data scanned: 0 B
Data read: 69 B (ratio 0.00:1)
Time: 12.426 sec (0 m 12 s)
Start Date: 2026:09:21 12:54:17
End Date: 2026:09:21 12:54:30
Compiling: 2s, ETA: 0s [=======================>] 42/42 tasks
WARNING: Can't open file /home/usuario/Downloads/eicar.com: Operation not permitted
----------- SCAN SUMMARY -----------
Known viruses: 3796968
Engine version: 1.5.3
Scanned directories: 0
Scanned files: 0
Infected files: 0
Total errors: 1
Data scanned: 0 B
Data read: 69 B (ratio 0.00:1)
Time: 12.426 sec (0 m 12 s)
Start Date: 2026:09:21 12:54:17
End Date: 2026:09:21 12:54:30
Clamdscan uses the parameters from the /etc/clamd.conf file for scans, as does Clamonacc for protection.
/home/kluster/Downloads: OK
----------- SCAN SUMMARY -----------
Infected files: 0
Time: 148.057 sec (2 m 28 s)
Start Date: 2026:09:24 00:07:13
End Date: 2026:09:24 00:09:41
----------- SCAN SUMMARY -----------
Infected files: 0
Time: 148.057 sec (2 m 28 s)
Start Date: 2026:09:24 00:07:13
End Date: 2026:09:24 00:09:41
/home/usuario/Downloads/eicar.com: Failed to open file. ERROR
----------- SCAN SUMMARY -----------
Infected files: 0
Total errors: 1
Time: 0.019 sec (0 m 0 s)
Start Date: 2026:09:21 12:56:14
End Date: 2026:09:21 12:56:14
----------- SCAN SUMMARY -----------
Infected files: 0
Total errors: 1
Time: 0.019 sec (0 m 0 s)
Start Date: 2026:09:21 12:56:14
End Date: 2026:09:21 12:56:14
We can see that Clamonacc in XFCE prevents either
Clamscan or Clamdscan from accessing the virulent file, neither
with sudo nor with the
_clamav
user itself .
However, when scanning
~/Downloads
, it only allows access with Clamscan and blocks it with
Clamdscan, because Clamd and Clamonacc use the same
/etc/clamd.conf file, while Clamscan is independent.
Let's comment out
the /home/your_username/Downloads directory in the file: https://docs.clamav.net/manual/Usage/Scanning.html#clamdscan Comment:
#OnAccessIncludePath /home/your_usuario/Downloads
Save and exit. ok: run: clamd: (pid 31196) 0s
ok: run: clamonacc: (pid 31276) 0s
Loading: 9s, ETA: 0s [========================>] 3.80M/3.80M
sigs
Compiling: 2s, ETA: 0s [========================>] 42/42 tasks
/home/usuario/Downloads/eicar.com: {HEX}test.test.eicar.1040.UNOFFICIAL FOUND
----------- SCAN SUMMARY -----------
Known viruses: 3796968
Engine version: 1.5.3
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 69 B
Data read: 69 B (ratio 1.00:1)
Time: 12.357 sec (0 m 12 s)
Start Date: 2026:09:21 12:58:58
End Date: 2026:09:21 12:59:10
Compiling: 2s, ETA: 0s [========================>] 42/42 tasks
/home/usuario/Downloads/eicar.com: {HEX}test.test.eicar.1040.UNOFFICIAL FOUND
----------- SCAN SUMMARY -----------
Known viruses: 3796968
Engine version: 1.5.3
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 69 B
Data read: 69 B (ratio 1.00:1)
Time: 12.357 sec (0 m 12 s)
Start Date: 2026:09:21 12:58:58
End Date: 2026:09:21 12:59:10
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
We see that the file has been read.
Note: For the file to be moved to quarantine, the
parameter
--move=/path/to/quarantine
must be passed in the command.
I first used Clamscan because it provides a more
complete output, but it takes longer because it loads the entire
database into RAM each time.
The result shows that the ClamAV engine is fully
operational and up-to-date with over 3.7 million known signatures.
It instantly identified the file as FOUND.
However, the command took 12,357 seconds to scan a
single file of just 69 bytes. This happens because Clamscan needs
to load all virus signatures into RAM from scratch every time it
is run.
Let's perform the same scan in fractions of a
millisecond using the clamdscan command with the
--stream
flag to send the file to the local daemon (Clamd) that is already
running in the background with the database pre-loaded into
RAM.
/home/usuario/Downloads/eicar.com:
{HEX}test.test.eicar.1040.UNOFFICIAL FOUND
----------- SCAN SUMMARY -----------
Infected files: 1
Time: 0.024 sec (0 m 0 s)
Start Date: 2026:09:21 13:01:34
End Date: 2026:09:21 13:01:34
----------- SCAN SUMMARY -----------
Infected files: 1
Time: 0.024 sec (0 m 0 s)
Start Date: 2026:09:21 13:01:34
End Date: 2026:09:21 13:01:34
Note that the scanning time has dropped from 12.357
seconds to just 0.024 seconds.
Loading: 10s, ETA: 0s [========================>] 3.80M/3.80M
sigs
Compiling: 2s, ETA: 0s [======================>] 42/42 tasks
/home/usuario/Downloads/images.jpeg: OK
/home/usuario/Downloads/26055.txt: OK
/home/usuario/Downloads/18153.txt: OK
/home/usuario/Downloads/5174256.png: OK
/home/usuario/Downloads/calvin-midia.webp: OK
/home/usuario/Downloads/biblia-terminal-main.zip: Sanesecurity.Foxhole.Zip_exe.UNOFFICIAL FOUND
/home/user/Downloads/0x0.webp: OK
/home/usuario/Downloads/demolition.webp: OK
/home/usuario/Downloads/idiocracy.webp: OK
/home/usuario/Downloads/celine-nietzsche.pdf: OK
/home/usuario/Downloads/Ardil-22 - Joseph Heller.pdf: OK
/home/usuario/Downloads/eicar.com: {HEX}test.test.eicar.1040.UNOFFICIAL FOUND
...
----------- SCAN SUMMARY -----------
Known viruses: 3797062
Engine version: 1.5.3
Scanned directories: 1
Scanned files: 54
Infected files: 2
Total errors: 1
Data scanned: 530.29 MiB
Data read: 742.51 MiB (ratio 0.71:1)
Time: 439.155 sec (7 m 19 s)
Start Date: 2026:09:24 07:51:59
End Date: 2026:09:24 07:59:19
Compiling: 2s, ETA: 0s [======================>] 42/42 tasks
/home/usuario/Downloads/images.jpeg: OK
/home/usuario/Downloads/26055.txt: OK
/home/usuario/Downloads/18153.txt: OK
/home/usuario/Downloads/5174256.png: OK
/home/usuario/Downloads/calvin-midia.webp: OK
/home/usuario/Downloads/biblia-terminal-main.zip: Sanesecurity.Foxhole.Zip_exe.UNOFFICIAL FOUND
/home/user/Downloads/0x0.webp: OK
/home/usuario/Downloads/demolition.webp: OK
/home/usuario/Downloads/idiocracy.webp: OK
/home/usuario/Downloads/celine-nietzsche.pdf: OK
/home/usuario/Downloads/Ardil-22 - Joseph Heller.pdf: OK
/home/usuario/Downloads/eicar.com: {HEX}test.test.eicar.1040.UNOFFICIAL FOUND
...
----------- SCAN SUMMARY -----------
Known viruses: 3797062
Engine version: 1.5.3
Scanned directories: 1
Scanned files: 54
Infected files: 2
Total errors: 1
Data scanned: 530.29 MiB
Data read: 742.51 MiB (ratio 0.71:1)
Time: 439.155 sec (7 m 19 s)
Start Date: 2026:09:24 07:51:59
End Date: 2026:09:24 07:59:19
Note that it flagged two viruses: the file
eicar.com
and the file
biblia-terminal-main.zip
as
Sanesecurity.Foxhole.Zip_exe.UNOFFICIAL FOUND
. This might be a false positive, but just to be safe, it was
quarantined.
https://sanesecurity.com/foxhole-databases/
Definitions:
- Known viruses: 3,797,062 - Database with 3,797,062 known malware types.
- Engine version: 1.5.3 - ClamAV version
- Scanned directories: 1 - Scanned directories
- Scanned files: 54 - Scanned files
- Infected files: 2 - Infected files
- Total errors: 1
- Data scanned: 530.29 MiB - Total data scanned
- Data read: 742.51 MiB (ratio 0.71:1) - Total data read
- Time: 439.155 sec (7 m 19 s) - Scan duration
- Start Date: 2026:09:24 07:51:59 - Start date/time
- End Date: 2026:09:24 07:59:19 - End date/time
Moving with Clamscan and Clamdscan
Depending on the settings, Clamonacc may block
Clamscan and Clamdscan, so, just to be safe, it's a good idea to
stop Clamonacc from scanning and start it again immediately
afterwards.
ok: down: clamonacc: 0s, normally up
For Clamscan and Clamdscan to move files to
quarantine, the parameter
--move=/path/to/quarantine
must be passed in the command for manual scans and also included
in the Cron file for automatic scans:
Password:
/home/usuario/Downloads/eicar.com: {HEX}test.test.eicar.1040.UNOFFICIAL FOUND
/home/usuario/Downloads/eicar.com: moved to '/var/opt/clamav-quarentena/eicar.com.008'
/home/usuario/Downloads/eicar.com: {HEX}test.test.eicar.1040.UNOFFICIAL FOUND
/home/usuario/Downloads/eicar.com: moved to '/var/opt/clamav-quarentena/eicar.com.008'
----------- SCAN SUMMARY -----------
Infected files: 1
Time: 0.010 sec (0 m 0 s)
Start Date: 2026:09:21 13:34:29
End Date: 2026:09:21 13:34:29
Infected files: 1
Time: 0.010 sec (0 m 0 s)
Start Date: 2026:09:21 13:34:29
End Date: 2026:09:21 13:34:29
cat: /home/user/Downloads/eicar.com: File or directory does not
exist
Loading: 9s, ETA: 0s [========================>] 3.80M/3.80M sigs
Compiling: 3s, ETA: 0s [========================>] 42/42 tasks
Compiling: 3s, ETA: 0s [========================>] 42/42 tasks
/home/usuario/Downloads/eicar.com:
{HEX}test.test.eicar.1040.UNOFFICIAL FOUND
/home/usuario/Downloads/eicar.com: moved to '/var/opt/clamav-quarentena/eicar.com.009'
/home/usuario/Downloads/eicar.com: moved to '/var/opt/clamav-quarentena/eicar.com.009'
----------- SCAN SUMMARY -----------
Known viruses: 3796968
Engine version: 1.5.3
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 69 B
Data read: 69 B (ratio 1.00:1)
Time: 12.660 sec (0 m 12 s)
Start Date: 2026:09:21 13:41:29
End Date: 2026:09:21 13:41:41
Known viruses: 3796968
Engine version: 1.5.3
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 69 B
Data read: 69 B (ratio 1.00:1)
Time: 12.660 sec (0 m 12 s)
Start Date: 2026:09:21 13:41:29
End Date: 2026:09:21 13:41:41
cat: /home/user/Downloads/eicar.com: File or directory does not
exist
ClamAV return codes: 0 = clean, 1 = infected, 2 = error
ok: run: clamonacc: (pid 15645) 0s
About Clamonacc
I recommend using Clamonacc only in certain folders
such as
/home/user/Downloads , /tmp , /var/tmp,
and
/dev/shm
, and even then, with caution, as processes may lose access to
files necessary for their operation if they are detected as false
positives. In that case, you will have to move them manually to
the list.
Clamonacc requires elevated privileges (
root
) to interact with the Kernel's fanotify API.
Giving global read permission (o+rx) to the
/home/username
folder allows other local users to see the list of public files in
your home directory. This is not recommended due to privacy and
security concerns. The alternative would be to add the user
_clamav to the personal user group and adjust the
AllowSupplementaryGroups
option in clamd.conf.
Based on the tests shown, we saw that Clamonacc, depending
on its settings, can block Clamscan and Clamdscan. Therefore, just to be
safe, we stopped Clamonacc from scanning and restarted it immediately
afterward.
Differences between Clamscan and Clamdscan
Clamd/Clamonacc
: These require the use of
/etc/clamd.conf
. The daemon runs in the background in memory, keeping the database
loaded for instant responses. It is ideal for lightweight real-time
monitoring of specific folders.
Since the virus database is already loaded into RAM by
the daemon (Clamd), Clamdscan is immensely faster to start and
consumes much less CPU with each run. It simply sends the file path to
the daemon to analyze and returns the result.
Clamdscan is best suited for manual scans of specific
files and directories.
For example, when you have a very large file to scan,
change `OnAccessMaxFileSize` to
XXXM
in `/etc/clamd.conf` and then run `
echo 'fs.inotify.max_user_watches=xxxxxxxxx' | sudo tee
/etc/sysctl.d/99-inotify.conf`
with the same size converted to bytes. Then return it to the standard
size you need so Clamonacc doesn't interfere with the system. In my
case, I leave it at 100 megabytes (100M).
Clamscan
: This is a standalone utility. It reads the signature database
directly from disk each time it runs. Because it scans on demand (via
cron or manually), it doesn't interfere with Clamonacc's behavior and
doesn't require you to modify the /etc/clamd.conf file.
Each time it runs, it needs to read all the database
signature files directly from disk and allocate everything back into
RAM, which consumes a lot of time and causes processing spikes.
However, for an automated Cron scan of the entire system
overnight, Clamscan is ideal.
A wrapper is a function, class, or library that wraps existing
code around it to simplify its interface, add new functionality, or
adapt its communication.
A file configured to perform the scan with Clamscan, which
will then be used in the Cron job.
Place inside:
Save and exit.
According to the tests shown, we saw that since
Clamonacc blocks even Clamscan and Clamdscan, we have to stop
Clamonacc for the scan and start it again immediately afterward, as
shown in the script.
Add /var/log/varredura.log:
Save and exit.
Checking:
In another terminal execute:
Save and exit.
cat: /home/usuario/teste/eicar.com: File or directory does not exist.
If you want, give it to:
or
Checking:
warning: logrotate in debug mode does nothing except printing debug
messages! Consider using verbose mode (-v) instead if this is not what
you want.
reading config file /etc/logrotate.d/clamav
Reading state from file: /var/lib/logrotate.status
Allocating hash table for state file, size 64 entries
Creating new state
Creating new state
Creating new state
Handling 1 logs
rotating pattern: /var/log/clamd.log /var/log/freshclam.log /var/log/varredura.log empty monthly log files are not rotated, (6 rotations), old logs are removed
considering log /var/log/clamd.log
Creating new state
Now: 2026-09-24 00:26
Last rotated at 2026-09-24 00:00
log does not need rotating (log has already been rotated)
considering log /var/log/freshclam.log
Creating new state
Now: 2026-09-24 00:26
Last rotated at 2026-09-24 00:00
log does not need rotating (log has already been rotated)
considering log /var/log/varredura.log
Creating new state
Now: 2026-09-24 00:26
Last rotated at 2026-09-24 00:00
log does not need rotating (log has already been rotated)
not running postrotate script, since no logs were rotated
reading config file /etc/logrotate.d/clamav
Reading state from file: /var/lib/logrotate.status
Allocating hash table for state file, size 64 entries
Creating new state
Creating new state
Creating new state
Handling 1 logs
rotating pattern: /var/log/clamd.log /var/log/freshclam.log /var/log/varredura.log empty monthly log files are not rotated, (6 rotations), old logs are removed
considering log /var/log/clamd.log
Creating new state
Now: 2026-09-24 00:26
Last rotated at 2026-09-24 00:00
log does not need rotating (log has already been rotated)
considering log /var/log/freshclam.log
Creating new state
Now: 2026-09-24 00:26
Last rotated at 2026-09-24 00:00
log does not need rotating (log has already been rotated)
considering log /var/log/varredura.log
Creating new state
Now: 2026-09-24 00:26
Last rotated at 2026-09-24 00:00
log does not need rotating (log has already been rotated)
not running postrotate script, since no logs were rotated
The -d parameter (debug mode) simply prints to the
screen everything it would do if it were actually running.
If you want to force log rotation right now, replace
the -d with the -f (force) parameter:
If you want to see what it's doing in real time while
it's actually running, use the verbose mode -v:
Testing the file in the /home/your_username/Downloads
directory:
ok: down: clamonacc: 1894s, normally up
In another terminal execute:
root 1927 99.0 3.3 1294288 1100592 pts/1 R+ 00:30 0:12 clamscan
--recursive --alert-broken --infected --log=/var/log/varredura.log
--move=/var/opt/clamav-quarentena
--exclude-dir=^/(proc|sys|dev|run|/var/run|/etc/sv|/etc/runit)
--exclude-dir=^/var/lib/_clamav --exclude-dir=^/var/log
--max-filesize=500M --max-scansize=1000M --max-scantime=0
--cross-fs=no --alert-exceeds-max=yes --alert-broken=yes
--alert-encrypted=yes --alert-macros=yes --detect-pua=yes
/home/kluster/Downloads
your_username 1982 0.0 0.0 6704 2628 pts/2 S+ 00:30 0:00 grep clamscan
your_username 1982 0.0 0.0 6704 2628 pts/2 S+ 00:30 0:00 grep clamscan
The root line indicates that the scan is occurring
with all parameters configured in the file.
To stop, press
Ctrl+c .
Now let's test a single directory to verify this. I
have a directory called
~/test
that I know is virus-free; let's add eicar to enhance the
test:
I left this part like this, adapt it to your liking:
#-------------------#
# Configuration
#-------------------#
TARGETS=(
# "/"
# "/home"
# "/var/www"
# "/etc"
"/home/your_username/test"
# add more directories here or set it to scan the root (/) and add more --exclude-dir below
)
# Configuration
#-------------------#
TARGETS=(
# "/"
# "/home"
# "/var/www"
# "/etc"
"/home/your_username/test"
# add more directories here or set it to scan the root (/) and add more --exclude-dir below
)
Save and exit.
ok: down: clamonacc: 1s, normally up
/home/kluster/teste/eicar.com: {HEX}test.test.eicar.1040.UNOFFICIAL FOUND
/home/kluster/teste/eicar.com: moved to '/var/opt/clamav-quarentena/eicar.com'
----------- SCAN SUMMARY -----------
Known viruses: 3811649
Engine version: 1.5.3
Scanned directories: 45
Scanned files: 576
Infected files: 1
Data scanned: 6.92 MiB
Data read: 5.87 MiB (ratio 1.18:1)
Time: 15.432 sec (0 m 15 s)
Start Date: 2026:09:23 15:12:44
End Date: 2026:09:23 15:12:59
ok: run: clamonacc: (pid 17328) 1s
/home/kluster/teste/eicar.com: {HEX}test.test.eicar.1040.UNOFFICIAL FOUND
/home/kluster/teste/eicar.com: moved to '/var/opt/clamav-quarentena/eicar.com'
----------- SCAN SUMMARY -----------
Known viruses: 3811649
Engine version: 1.5.3
Scanned directories: 45
Scanned files: 576
Infected files: 1
Data scanned: 6.92 MiB
Data read: 5.87 MiB (ratio 1.18:1)
Time: 15.432 sec (0 m 15 s)
Start Date: 2026:09:23 15:12:44
End Date: 2026:09:23 15:12:59
ok: run: clamonacc: (pid 17328) 1s
cat: /home/usuario/teste/eicar.com: File or directory does not exist.
If you want, give it to:
or
And finally, confirm that Clamonacc has started (even
though the output shows this at the end):
run: clamonacc: (pid 17328) 62s
We can see that the final test went well.
He scanned the files and found eicar.com, moving it to
quarantine and "activating" Clamonacc.
Remember that it's necessary to disable Clamonacc
during scans because, as we've seen, it prevents both Clamdscan and
Clamscan from operating on protected files and directories.
You can leave Clamonacc enabled during scans, and only
directories and files protected by Clamonacc will not be scanned.
However, I prefer to disable it to avoid conflicts and potential
crashes because, as we've seen, Clamonacc acts directly on the
Kernel.
Next, remember to set TARGETS to root (/) in the
/usr/local/bin/scanning.sh
file and add as many exclusions as you want with the
--exclude-dir
parameter .
ClamAV return codes: 0 = clean, 1 = infected, 2 = error
Opening Cron:
or
or
Or
configure ~/.bashrc permanently, otherwise the command " sudo crontab -e " will open vi by default in Void and you will never be able to exit it.
Place the following inside:
Save and exit.
TESTING CRON
Write a line like this:
To remove completely:
or
Or
configure ~/.bashrc permanently, otherwise the command " sudo crontab -e " will open vi by default in Void and you will never be able to exit it.
Place the following inside:
Save and exit.
Configure the days and times when the computer/server is
turned on, that is, configure it according to your needs.
25 15 * * * /usr/local/bin/varredura.sh >>
/var/log/varredura.log 2>&1
Adjust to a nearby time; it's set to start the scan at
3:25 PM. No message will appear on the terminal.
Please wait for it to finish and view the log:
Time: 15.479 sec (0 m 15 s)
Start Date: 2026:09:23 15:25:00
End Date: 2026:09:23 15:25:16
ok: run: clamonacc: (pid 19885) 0s 2026-09-23 15:25:16 - End of
scan (exit code: 1)
Note that it started at 3:25 PM.
And if you also configured monitor-quarentena.sh in
Cron, you should see the message on the screen (Notify-send or
Zenity).
$ sudo sv stop clamd
$ sudo sv stop clamonacc
$ sudo xbps-remove clamav
$ sudo userdel _clamav
$ sudo groupdel _clamav
$ sudo umount /var/opt/clamav-quarantena
$ sudo rm -rf /var/opt/clamav-quarentena
Don't forget to comment out or delete the line in /etc/fstab:
$ sudo vim /etc/fstab
$ sudo rm -rf /var/log/freshclam.log
$ sudo rm -rf /var/log/clamd.log
$ sudo rm -rf /var/run/clamav
$ sudo rm /var/service/clamd
$ sudo rm -rf /etc/sv/clamd
$ sudo rm /var/service/clamonacc
$ sudo rm -rf /etc/sv/clamonacc
$ sudo rm -rf /etc/logrotate.d/clamav-quarantena
$ sudo rm -rf /run/runit/supervise.clamd
$ sudo rm -rf /run/runit/supervise.clamd-log
$ sudo sv stop clamonacc
$ sudo xbps-remove clamav
$ sudo userdel _clamav
$ sudo groupdel _clamav
$ sudo umount /var/opt/clamav-quarantena
$ sudo rm -rf /var/opt/clamav-quarentena
Don't forget to comment out or delete the line in /etc/fstab:
$ sudo vim /etc/fstab
$ sudo rm -rf /var/log/freshclam.log
$ sudo rm -rf /var/log/clamd.log
$ sudo rm -rf /var/run/clamav
$ sudo rm /var/service/clamd
$ sudo rm -rf /etc/sv/clamd
$ sudo rm /var/service/clamonacc
$ sudo rm -rf /etc/sv/clamonacc
$ sudo rm -rf /etc/logrotate.d/clamav-quarantena
$ sudo rm -rf /run/runit/supervise.clamd
$ sudo rm -rf /run/runit/supervise.clamd-log
Optional:
$ sudo rm -rf /etc/freshclam.conf
$ sudo rm -rf /etc/clamd.conf
$ sudo rm -rf /etc/clamav-milter.conf
$ sudo rm -rf /usr/local/bin/clear-quarantine.sh
$ sudo rm -rf /usr/local/bin/monitor-quarantine.sh
IMPORTANT WARNING:
Do not use recursive protection with Clamonacc (real-time protection), as it will practically slow down the system and may even crash it.
Do not use recursive protection with Clamonacc (real-time protection), as it will practically slow down the system and may even crash it.
It can have multiple parameters. OnAccessIncludePath:
OnAccessPrevention yes
OnAccessDisableDDD yes
OnAccessIncludePath /home
OnAccessIncludePath /home/usuario
OnAccessIncludePath /home/usuario/Downloads
OnAccessIncludePath /home/usuario/Downloads/folder
OnAccessDisableDDD yes
OnAccessIncludePath /home
OnAccessIncludePath /home/usuario
OnAccessIncludePath /home/usuario/Downloads
OnAccessIncludePath /home/usuario/Downloads/folder
The above configuration will result in non-recursive
real-time protection of directories; that is, the parameter "
OnAccessIncludePath /home/usuario
" will only protect in real time the files that are there, but
will not protect the directories (folders) inside
/home/usuario
. Any access attempts detected by Clamonacc on malicious files
within
/home/usuario
will be blocked by the Kernel through fanotify, as we will see in
the tests later on.
For the type of protection with automatic locking,
the basic parameters to be enabled are as follows:
OnAccessIncludePath /home/usuario/folder
OnAccessExcludeUname clamav
OnAccessPrevention yes
OnAccessDisableDDD yes
OnAccessExcludeUname clamav
OnAccessPrevention yes
OnAccessDisableDDD yes
With "
OnAccessPrevention yes
", when attempting to access a malicious file with, for example, cat
eicar.com, ClamAV, through the Kernel's fanotify, will issue a
notification:
cat: eicar.com: Operation not permitted
With "
OnAccessPrevention no
", when attempting to access a malicious file, access will be
allowed.
I set "
OnAccessDisableDDD yes
" because DDD fails to recursively apply kernel markings to
directories that already existed before the service started, so to
avoid conflicts, it's better to disable it and set the folders you
want to have immediate blocking.
Either way, you'll need a script to move the
infected files to quarantine or use the "
--move=/path/to/quarantine
" parameter, as ClamAV doesn't handle this type of control.
Clamscan, Clamonacc, and Clamdscan include the "
--remove
" option to delete any file that generates alerts during a scan.
This is generally a very bad idea unless you are monitoring an
uploads/downloads directory. False positives happen! You don't
want the wrong file to be accidentally deleted. Instead, consider
using the "
--move
" parameter or perhaps just "
--copy
" and set up a script with the "
VirusEvent
" feature to notify you when something is detected.
CASE 0x0
If the user needs to monitor the entire file system,
but blocking malicious access attempts is not a concern:
OnAccessMountPath /
OnAccessExcludeRootUID yes
OnAccessExcludeUname clamav
OnAccessExcludeRootUID yes
OnAccessExcludeUname clamav
This setting will enable the
On-Access Scanner notify-only
option. It will also ensure that only user processes that are
neither root nor clamav trigger filesystem checks. Processes
started by root and the ClamAV user (_clamav or clamav) will not
trigger checks and therefore notifications; In other words, ClamAV
will do nothing. This is often necessary to prevent a loop in root
and/or ClamAV user processes.
To move infected files to quarantine and clear the
quarantine after a certain time, a script is necessary, as we will
see.
The
OnAccessMountPath
parameter uses a different fanotify API configuration, making it
incompatible with OnAccessIncludePath and the DDD system. This
also means that the following options cannot be used in
conjunction with
OnAccessMountPath :
- OnAccessExtraScanning is built around capturing inotify events.
- OnAccessExcludePath - is based on the DDD system.
- OnAccessPrevention - locks the system ifOnAccessMountPath is selected .
If you need
OnAccessPrevention yes
, use
OnAccessIncludePath
and
OnAccessExcludePath .
CASE 0x1
If the system administrator needs to monitor the
home directory of several users, but not all, and it is not
necessary to block access attempts, but only to notify them:
OnAccessIncludePath /home
OnAccessExcludePath /home/usario2
OnAccessExcludePath /home/usuario4
OnAccessExcludeUname clamav
OnAccessExcludePath /home/usario2
OnAccessExcludePath /home/usuario4
OnAccessExcludeUname clamav
With this configuration, the On-Access Scanner will
recursively monitor the entire
/home
directory in notify-only mode. The directories
/home/user2
and
/home/user4
will be recursively excluded from the scan.
To move infected files to quarantine and clear the
quarantine after a certain time, a script is necessary, as we have
seen.
Observation:
"OnAccessIncludePath /", that is, "OnAccessIncludePath" in
the root directory, is NOT accepted as a valid
parameter!
ClamAV on Linux:
Checking the kernel configuration for the presence of fanotify: Updating and installing: Verify that the ClamAV user and group have been created:
Creating Log Files
for Freshclam: For Clamd: Setting the database directory to the correct owner (check if it's _clamav or clamav): See article.
See article.
NOTICE
QUARANTINE
Creating directory and file and setting permissions:
Assembling immediately:
See article.
Permissioning:
See article.
Permissioning:
See article.
Logrotate
See article.
See article.
Updating database:
or
If you wish, you can run it again:
Clamonacc
See article.
Testing bash: /home/user/Downloads/eicar.com: Operation not permitted
Notice that the file has been moved to quarantine:
cat: /home/usuario/Downloads/eicar.com: Operation not permitted
Testing Scan
Clamscan Wrapper
See article.
Create the scan log file:
See article.
Checking:
Checking the kernel configuration for the presence of fanotify: Updating and installing: Verify that the ClamAV user and group have been created:
If it hasn't already been created in your
distribution, create the user (in Void, when installing
ClamAV
, the _clamav user and group are created automatically, so you can
skip these two commands):
If your operating system does not have the groupadd
and useradd utilities, install them.
Let's remove the file extension:
Creating a directory for the local socket and setting permissions
(verify the correct username):
for Freshclam: For Clamd: Setting the database directory to the correct owner (check if it's _clamav or clamav): See article.
See article.
NOTICE
The number there is 100M converted to bytes. This
number must be the same as the
OnAccessMaxFileSize
parameter . If you change the number in the OnAccessMaxFileSize
parameter, you must run this command again with the new
number.
QUARANTINE
Creating directory and file and setting permissions:
Add the following line at the end to apply strict
security restrictions (noexec, nosuid, and nodev prevent the execution
of programs, SUID binaries, and the creation of devices):
...
/var/opt/clamav-quarantena /var/opt/clamav-quarantena none
bind,noexec,nosuid,nodev 0 0
Permissioning:
See article.
Permissioning:
See article.
See article.
If you wish, you can run it again:
Testing bash: /home/user/Downloads/eicar.com: Operation not permitted
This must be happening because in the
/etc/clamd.conf file, the path
/home/user/Downloads
is in the
OnAccessIncludePath .
We'll do it with sudo:
Attempting to read the file:
cat: /home/usuario/Downloads/eicar.com: Operation not permitted
cat: /home/user/Downloads/eicar.com: File or directory does not
exist
cat: /home/user/Downloads/eicar.com: File or directory does not
exist
We can see that clamonacc (Real-Time Protection)
prevents either clascam or clamdscan from accessing the virulent file,
neither with sudo nor with the _clamav (or clamav) user itself.
Let's comment out the /home/user/Downloads
directory in the file:
Comment
#OnAccessIncludePath /home/usuario/Downloads
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Note: For the file to be moved to quarantine, the
parameter "
--move=/path/to/quarantine
" must be passed in the command, as we will see later.
cat: /home/user/Downloads/eicar.com: File or directory does not
exist
cat: /home/user/Downloads/eicar.com: File or directory does not
exist
Checking:
The -d parameter (debug mode) simply prints to the
screen everything it would do if it were actually running.
If you want to force log rotation right now, replace the
-d with the -f (force) parameter:
If you want to see what it's doing in real time while it's actually
running, use the verbose mode -v:
Testing the file:
ok: down: clamonacc: 1894s, normally upIn another terminal execute:
Now let's test a single directory to prove it.
I have a directory in
~/test
that I know is virus-free; let's add
eicar
to enhance the test:
I left this part like this, adapt it to your liking:
#-------------------#
# Configuration
#-------------------#
TARGETS=(
# "/"
# "/home"
# "/var/www"
# "/etc"
"/home/your_username/test"
# add more directories here or set it to scan the root (/) and add more --exclude-dir below
)
# Configuration
#-------------------#
TARGETS=(
# "/"
# "/home"
# "/var/www"
# "/etc"
"/home/your_username/test"
# add more directories here or set it to scan the root (/) and add more --exclude-dir below
)
cat: /home/usuario/teste/eicar.com: File or directory does not exist
If you want, give it:
CRON
or
or
or
or
or
Configure
~/.bashrc
permanently, otherwise the command
sudo crontab -e
will open vi by default in Void and you will never be able to exit
it.
To remove completely:
Don't forget to comment out or delete the line in /etc/fstab:
Optional:
As we have seen, it is not difficult, but it is laborious.
You'll get the hang of it in no time.
HTOP
Simply press
Shift + O
and type
COMMAND=clamonacc
to filter by process only, or search for clamonacc in the
list.
File: /var/lib/_clamav/main.cvd
Build time: 16 Dec 2025 23:18 +0000
Version: 63
Signatures: 3287027
Functionality level: 90
Builder: tomjudge
MD5: 9c353a6b32555186a45a61c6441f38c0
Digital signature: gI9w3cezaElJbedEoiykyQeX1f6j9Xbs3a+cf9U/kH5QScGMe2mRz1K2JlYOrqfBuOUMbiKmvkVvAquOsMeDp /ejLVDx5WulC6klZVhLOfBHda29OjaLZwEGR9GPIHDr0mXriv7pivuMH60/loxpASIJHLOszyj95pxVK+EaTCh
Verification OK.
Build time: 16 Dec 2025 23:18 +0000
Version: 63
Signatures: 3287027
Functionality level: 90
Builder: tomjudge
MD5: 9c353a6b32555186a45a61c6441f38c0
Digital signature: gI9w3cezaElJbedEoiykyQeX1f6j9Xbs3a+cf9U/kH5QScGMe2mRz1K2JlYOrqfBuOUMbiKmvkVvAquOsMeDp /ejLVDx5WulC6klZVhLOfBHda29OjaLZwEGR9GPIHDr0mXriv7pivuMH60/loxpASIJHLOszyj95pxVK+EaTCh
Verification OK.
Or
File: /var/lib/_clamav/daily.cld
Build time: 23 Sep 2026 06:24 +0000
Version: 28132
Signatures: 355666
Functionality level: 90
Builder: svc.clamav-publisher
Verification OK.
Build time: 23 Sep 2026 06:24 +0000
Version: 28132
Signatures: 355666
Functionality level: 90
Builder: svc.clamav-publisher
Verification OK.
The main.cvd
file
is the primary repository of stable ClamAV signatures and is
updated very rarely (usually once or twice a year). The current
and most recent version globally is Version 63, generated by
developer
tomjudge
on December 16, 2025, containing the 3,287,027 signatures listed
in the output.
The
main.cvd file
will remain static in version 63 for some time, while the
daily.cld
file will change versions and display the current date every
time
Freshclam
is run .
The quarantine script is operating on a fully
updated database.
Remember that Freshclam updates occur
automatically twice a day according to the
Checks 2 parameter in the/etc/freshclam.conf
file
, and a third time a day if you've added it to a cron
job.
When daily updates occur, Freshclam only modifies
the
daily.cvd
(or
daily.cld
) file.
Main database files:
- main.cvd : The main static database.
- daily.cvd (or daily.cld ): This one changes multiple times a day to include recent threats (Ransomware, Phishing, and new malware).
- bytecode.cvd : Updated sporadically to reflect new scanning engine logic.
Verify/authorize false positives:
High-Level Software Diagram
https://docs.clamav.net/manual/Usage.html
Most Frequently Viewed Directories and Files
1)
Temporary Directories: (Target #1) These are the most common locations because any user of the system (or vulnerable web service, such as a WordPress site or a PHP application) has full permission to write files to them./tmp : The global temporary directory. Virtually 90% of automated attack scripts (such as cryptocurrency miners and DDoS bots) download their binaries here before executing them./var/tmp : Similar to /tmp, but files here are not deleted when the system restarts. Attackers use this location to try to maintain persistence on the server./dev/shm : This is the shared memory directory. Files placed here run directly in RAM, making them extremely fast and often invisible to traditional disk monitoring tools.
2)
Web Service and Upload Directories: If your Linux system runs a web server (Apache, Nginx) or databases, the attacker will exploit vulnerabilities in the application to inject files (usually web shells in PHP, Python, or Perl)./var/www/html/ (or upload subfolders like wp-content/uploads in WordPress): Where malicious code is injected so that the attacker can remotely control the server through the browser./var/spool/samba/ or network share folders: If Samba is misconfigured, Windows malware (such as ransomware) can be placed there to infect other computers on the network.
3)
Hidden Directories in User Profiles (/home): When the attack specifically targets a user's account (via SSH password theft or private key theft), malicious binaries are often hidden within hidden folders in /home to avoid simple visual detection (common ls commands do not show them)./home/user/.config/ or /home/user/.local/ : Legitimate folders where malware disguises itself as system configuration files./home/user/.ssh/ : Although they don't place the malware here, attackers inject public keys into the authorized_keys file in this folder to ensure they can re-enter the system whenever they want, without needing a password.
Nenhum comentário:
Postar um comentário