You can view the documentation below, or browse our GitHub Repository, where you can contribute to user manual and FAQ.
If you are running ClamAV 0.7x please upgrade now.
If you are running ClamAV 0.8x or later, you can check for database update as often as 4 times per hour provided that you have the following options in
Please run clamscan with the
--detect-broken option. Also check that freshclam and clamscan are using the same path for storing/reading the database.
Our virus database is kept up to date with the help of the community. Whenever you find a new virus which is not detected by ClamAV you should complete this form. The virusdb team will review your submission and update the database if necessary. Before submitting a new sample: - check that the value of DatabaseDirectory, in both clamd.conf and freshclam.conf, is the same - and update your database by running freshclam to ensure you’ve scanned it with the latest virus database.
ClamAV comes with freshclam, a tool which periodically checks for new database releases and keeps your database up to date.
There is a problem with your DNS server. Please check the entries in
/etc/resolv.conf and verify that you can resolve the TXT record manually:
$ host -t txt current.cvd.clamav.net
If you can’t, it means your network is broken. You’ll be still able to download the updates, but you’ll waste a lot of bandwidth checking for updates.
Either your dns servers are not working or you are blocking port 53/tcp. You should manually check that you can resolve hostnames with:
$ host database.clamav.net
If it doesn’t work, check your dns settings in
/etc/resolv.conf. If it works, check that you can receive dns answers longer than 512 bytes, e.g. check that your firewall is not blocking packets which originate from port 53/tcp. An easy way to find it out is:
$ dig @ns1.clamav.net db.us.big.clamav.net
Try to download
daily.cvd with curl, wget, or lynx from the same machine that is running freshclam. Future versions of freshclam will provide a better way to deal with this.
mirrors.dat is used by freshclam to keep track of broken mirrors. It avoids the unnecessary delays caused by trying to download a CVD update from a mirror which failed multiple times during the last 24 hours.
Sure, you can find more details on our Private Local Mirror page.
If you want to take advantage of incremental updates, install a proxy server and then configure your freshclam clients to use it (watch for the HTTPProxyServer parameter in man freshclam.conf).
The second possible solution is to:
Configure a local webserver on one of your machines (say machine1.mylan)
Let freshclam download the
*.cvd files from http://database.clamav.net to the webserver’s DocumentRoot.
Finally, change freshclam.conf on your clients so that it includes:
First the database will be downloaded to the local webserver and then the other clients on the network will update their copy of the database from it.
Important: For this to work, you have to add
ScriptedUpdates off on all of your machines!
No problem, save your own signatures in a text file with the appropriate extension (see our signature writing documentation for more information). Put the signature file in the same directory where the
.cvd files are located. ClamAV will load it after the official
.cvd files. You do not need to sign the
Yes, the virusdb can be downloaded from the Latest releases section on our home page.
current.cvd.clamav.net has got only a TXT record, not a type A record! Try this command:
$ host -t txt current.cvd.clamav.net
Please note that some not RFC compliant DNS servers (namely the one shipped with the Alcatel (now Thomson) SpeedTouch 510 modem) can’t resolve TXT record. If that’s the case, please recompile ClamAV with the flag
You will need to edit the
freshclam.conf.example file located in
/usr/local/etc. Once that is done, you will need to run a
sudo freshclam to download the signatures. You will need to run the command to update signatures often so that ClamAV has the most up to date signatures.