Clam AntiVirus

Clam AntiVirus (ClamAV) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, OSF (Tru64), Solaris and Haiku. As of version 0.97.5, ClamAV builds and runs on Microsoft Windows.[2][3] Both ClamAV and its updates are made available free of charge. One of its main uses is on mail servers as a server-side email virus scanner.

Clam AntiVirus
Developer(s)Cisco Systems
Stable release
1.2.1[1] Edit this on Wikidata / 25 October 2023
Repository
Written inC, C++
Operating systemUnix, AIX, BSD, HP-UX, Linux, macOS, OpenVMS, Tru64 UNIX, Windows, Haiku
TypeAntivirus software
LicenseGPL-2.0-only
Websitewww.clamav.net

Sourcefire, developer of intrusion detection products and the owner of Snort, announced on 17 August 2007 that it had acquired the trademarks and copyrights to ClamAV from five key developers.[4] Upon joining Sourcefire, the ClamAV team joined the Sourcefire Vulnerability Research Team (VRT). In turn, Cisco acquired Sourcefire in 2013.[5] The Sourcefire VRT became Cisco Talos,[6] and ClamAV development remains there.

Features

ClamAV includes a command-line scanner, automatic database updater, and a scalable multi-threaded daemon running on an anti-virus engine from a shared library.[2] The application features a Milter interface for sent mail and on-demand scanning. It recognizes:

The ClamAV virus database is updated at least every four hours and as of 10 February 2017 contained over 5,760,000 virus signatures with the daily update Virus DB number at 23040.[7][8]

Effectiveness

ClamAV was tested against other antivirus products on Shadowserver. In 2011, Shadowserver tested over 25 million samples against ClamAV and numerous other antivirus products. Out of the 25 million samples tested, ClamAV scored 76.60% ranking 12 out of 19, a higher rating than some much more established competitors.[9]

In the 2008 AV-TEST comparison of antivirus tools, ClamAV scored poorly in on-demand detection, avoiding false positives, and rootkit detection.[10]

In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28%.[11]

In 2022 Splunk conducted an efficacy study involving ~400,000 malware samples sourced from MalwareBazaar. The study concluded ClamAV is 59.94% effective overall at detecting commodity malware.[12]

Unofficial databases

The ClamAV engine can be reliably used to detect several kinds of files. In particular, some phishing emails can be detected using antivirus techniques. However, false positive rates are inherently higher than those of traditional malware detection.[13]

There are several unofficial databases for ClamAV:

  • Sanesecurity is an organization that maintains a number of such databases; in addition they distribute and classify a number of similar databases from other parties, such as Porcupine, Julian Field, MalwarePatrol.[14]
  • SecuriteInfo.com also provides additional signatures for ClamAV.[15]

ClamAV Unofficial Signatures are mainly used by system administrators to filter email messages.[16] Detections of these groups should be scored, rather than causing an outright block of the "infected" message.[14]

Platforms

Linux, BSD

ClamAV is available for Linux and BSD-based operating systems.[2] In most cases it is available through the distribution's repositories for installation.

On Linux servers ClamAV can be run in daemon mode, servicing requests to scan files sent from other processes. These can include mail exchange programs, files on Samba shares, or packets of data passing through a proxy server.

On Linux and BSD desktops ClamAV provides on-demand scanning of individual files, directories or the whole PC.[2]

macOS

macOS Server has included ClamAV since version 10.4. It is used within the operating system's email service. A paid-for graphical user interface is available from Canimaan Software Ltd[17] in the form of ClamXav.[18] Additionally, Fink, Homebrew and MacPorts have ported ClamAV.

Another program which uses the ClamAV engine on macOS, is Counteragent. Working alongside the Eudora Internet Mail Server program, Counteragent scans emails for viruses using ClamAV and also optionally provides spam filtering through SpamAssassin.

OpenVMS

ClamAV for OpenVMS is available for DEC Alpha and Itanium platforms. The build process is simple and provides basic functionality, including library, the clamscan utility, the clamd daemon, and freshclam for update.[19]

Windows

There are IA-32 and x64 variants of ClamAV available for Windows; additionally, Cisco's Immunet uses ClamAV as its engine.[20]

OS/2

A port of ClamAV is available for OS/2 (including eComStation and ArcaOS) with a native UI written in REXX.[21][22]

Graphical interfaces

Since ClamAV does not include a graphical user interface (GUI) but instead is run from the command line, a number of third-party developers have written GUIs for the application for various platforms and uses.

These include:

ClamTk 5.27 running on Lubuntu 19.04
  • Linux
    • ClamTk using gtk2-perl; project is named for the Tk libraries that were used when it began[23][24]
    • KlamAV for TDE (development of the original KDE version was discontinued in 2009[25]).
    • wbmclamav is a webmin module to manage Clam AntiVirus[26]
  • macOS
    • ClamXav is a port which includes a graphical user interfaces and has a "sentry" service which can watch for changes or new files in many cases. There is also an update and scanning scheduler through a cron job facilitated by the graphical interface. ClamXav can detect malware specific to macOS, Unix, or Windows. The ClamXav application and the ClamAV engine are updated regularly.[27] ClamXav is written and sold by Canimaan Software Ltd.[17]
    • Tiger Cache Cleaner is shareware software which installs and presents a graphic interface for using ClamAV to scan for viruses, and provides other unrelated functions.
  • Microsoft Windows
  • OS/2

ClamWin
Main article: ClamWin Free Antivirus
ClamWin running on Windows XP

ClamWin is a graphical user interface front-end ClamWin Pty Ltd. developed for ClamAV on Microsoft Windows. Features include on-demand (user-started) scanning, automatic updates, scheduled scanning, and integration with File Explorer and Microsoft Outlook. ClamWin does not provide on-access scanning. A Firefox add-on enables ClamWin to scan downloaded files.[29][30] Several other extensions allow users to process downloaded files with any software and scan the files with ClamWin.[31][32][33][34]

Real-time file scanning

On Linux, ClamAV (versions 0.99 and later) supports real-time protection via the Fanotify add-on for the Linux kernel (version 3.8 and later.)[35] Alternatively, one could use ClamFS (for any Unix-like operating system supporting FUSE).

On Microsoft Windows, a free, open-source app called Clam Sentinel detects file changes and scans modified files using ClamWin.[36] It works with Windows 98 and later. In addition to on-access scanning, it features optional system change messages and proactive heuristic protection.[37]

Patent lawsuit

In 2008, Barracuda Networks was sued by Trend Micro for its distribution of ClamAV as part of a security package.[38] Trend Micro claimed that Barracuda's utilization of ClamAV infringes on a software patent for filtering viruses on an Internet gateway. The free software community responded in part by calling for a boycott against Trend Micro. The boycott was also endorsed by the Free Software Foundation.[39] Barracuda Networks counter-sued with IBM-obtained patents in July 2008.[40] On May 19, 2011, the U.S. Patent and Trademark Office issued a Final Rejection[41] in the reexamination of Trend Micro's U.S. patent 5,623,600.[42]

See also

References
  1. Micah Snyder (25 October 2023). "ClamAV 1.2.1, 1.1.3, 1.0.4, 0.103.11 patch versions published". Retrieved 25 October 2023.
  2. ClamAV (2007). "About ClamAV". Retrieved 2008-12-25.
  3. ClamAV (2007). "ClamAV Packages and Ports". Archived from the original on 2008-07-20. Retrieved 2008-12-31.
  4. "Sourcefire acquires ClamAV". ClamAV. 2007-09-17. Archived from the original on 2007-12-15. Retrieved 2008-02-12.
  5. "Cisco Completes Acquisition of Sourcefire". cisco.com. 2013-10-07. Retrieved 2014-06-18.
  6. "Cisco Talos". 2018-01-19.
  7. "About ClamAV". Archived from the original on 2008-11-20. Retrieved 2008-12-25.
  8. "Latest Stable Release". Archived from the original on 2010-09-18. Retrieved 2010-08-21.
  9. "ShadowServer Yearly Stats". shadowserver.org. 2012-01-05. Archived from the original on 2011-06-25. Retrieved 2012-01-05.
  10. "Anti-virus comparison test of current anti-malware products, Q1/2008". AV-Test GmbH. 22 January 2008. Archived from the original on 15 July 2011. Retrieved 12 February 2008.
  11. "ShadowServer 180 Day Stats". shadowserver.org. 2011-08-16. Archived from the original on 2011-11-27. Retrieved 2011-12-16.
  12. "How Good is ClamAV at Detecting Commodity Malware?". Splunk-Blogs.
  13. Brad Wardman; Tommy Stallings; Gary Warner; Anthony Skjellum (5 August 2011). "High-Performance Content-Based Phishing Attack Detection" (PDF). uab.edu. Retrieved 19 March 2018.
  14. Sanesecurity Phishing, Scam and Malware signatures for ClamAV Archived 2015-09-10 at the Wayback Machine
  15. SecuriteInfo.com Add 4.000.000 signatures to ClamAV Antivirus
  16. "ClamAV Unofficial Signatures Updater". sourceforge.net. 24 May 2009. Retrieved 2 September 2014.
  17. "About us". ClamXAV. Retrieved 2017-07-15.
  18. ClamXav.com (n.d.). "ClamXAV.com". Retrieved 2009-01-24.
  19. Chupahin, Alexey (December 2008). "Clam AntiVirus OpenVMS Project News". Archived from the original on 2011-10-06. Retrieved 2008-12-25.
  20. "Alternate Versions of ClamAV". clamav.net. Cisco Systems. Archived from the original on 22 November 2021. Retrieved 26 November 2021. Immunet, powered by ClamAV, is a [...] Windows desktop anti-virus (AV) solution
  21. "My graphical user interface for "ClamAV"". Retrieved 2020-09-03.
  22. "Clamav, ClamAV-GUI (Rexx & QT4) & eCSClamav". Retrieved 2020-09-03.
  23. Mauroni, Dave (December 2008). "ClamTk Virus Scanner". Retrieved 2008-12-25.
  24. Mauroni, Dave (October 2008). "ClamTk README". Archived from the original on 2011-09-14. Retrieved 2008-12-26.
  25. KlamAV F. (May 2006). "KlamAV - Main Page". Retrieved 2013-03-04.
  26. Saracco, Emmanuel. "wbmclamav - The Webmin ClamAV Antivirus manager". wbmclamav.esaracco.fr.
  27. ClamXav.com (November 2008). "ClamXav.com". Retrieved 2008-12-25.
  28. "CS Anti-Virus description". Softpedia.com. 2009-03-23. Retrieved 2010-11-09.
  29. "FireClam: Use ClamAV to scan Firefox downloads for viruses". Firefox Addons. Retrieved 2009-11-02.
  30. "ClamWin Antivirus Glue for Firefox". Firefox Addons. Archived from the original on 2012-12-20. Retrieved 2008-04-15.
  31. "Download Scan". Downloadstatusbar.mozdev.org. 2005-08-19. Retrieved 2010-11-09.
  32. "Download Statusbar".
  33. "Safe Download". Extensions.geckozone.org. Retrieved 2010-11-09.
  34. ClamWin Pty Ltd (2009). "About ClamWin Free Antivirus". Archived from the original on 2010-01-25. Retrieved 2009-03-13.
  35. Sola, Mickey. "Configuring On-Access Scanning in ClamAV".
  36. Cyber Pillar. "Clam Sentinel - Making ClamWin Be Used In Real-Time". Retrieved 2014-09-01.
  37. "Clam Sentinel". Retrieved 2014-06-19.
  38. "Trend Micro patent claim provokes FOSS community, leads to boycott". Linux.com. 2008-02-11. Retrieved 2008-02-12.
  39. "Boycott Trend Micro". Free Software Foundation. 2008-02-11. Retrieved 2008-02-12.
  40. Paul, Ryan (2008-07-02). "Barracuda bites back at Trend Micro in ClamAV patent lawsuit". Arstechnica.com. Retrieved 2012-02-14.
  41. "Ex Parte Reexamination" (PDF). U.S. Patent and Trademark Office. 2011-05-19. Retrieved 2015-10-04.
  42. "Anatomy of a Dying Patent - The Reexamination of Trend Micro's '600 Patent". Groklaw.net. 2011-06-13. Retrieved 2015-10-04.

Further reading
Wikimedia Commons has media related to ClamAV.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.