ClamAV

ClamAV is an open-source antivirus engine maintained by Cisco Talos. It has been the standard choice for scanning mail gateways and file uploads on servers for years, and it also runs on Windows as an on-demand scanner. The Windows installer provides the engine, the command-line scanner, a daemon that can answer scan requests and the updater that keeps the signature database current.

What the engine detects

Detection covers malware, potentially unwanted applications and many archive and document formats, because the engine unpacks containers before scanning what is inside. Signatures arrive as versioned database files that the updater refreshes, and the same engine processes enormous volumes of attachments on mail gateways and content scanners. On Windows it behaves as a scanner rather than a background monitor, inspecting files when you ask it to rather than as they are opened.

Scanning, updating and where it fits

A scan is started with a command against a file, a folder or a whole drive, and results are printed or written to a log. The updater pulls signature and engine updates over the internet from the project's distribution servers, and it should be scheduled or run manually before important scans, since a stale database detects much less. On Windows, ClamAV does not install a real-time file system filter: it inspects files when asked to, not as they are opened. That single fact determines the right use case. It suits scanning a download folder, checking a USB drive, verifying files on a file server, or adding a second opinion to an existing security setup. For web browsers, mail clients and everyday desktop use, it is a complement rather than a replacement for the protection already built into Windows.

Configuration and practical limits

The behaviour of the daemon and the updater is controlled by configuration files that ship with the package, and the project documentation explains options for archive size limits, exclusions, log paths and scheduled scans. Signature updates need outbound internet access; on locked-down networks the update files have to be fetched by other means. The database is large, so the first update takes a while. Archive scanning is deliberately bounded, because a deeply nested or huge archive can consume enormous memory and time, and those limits exist for good reason. False positives are possible with any signature engine, and the log should be reviewed before deleting anything that is flagged. Scans of network shares are limited by disk speed, and scanning a whole machine takes far longer than scanning the folders that actually receive new files.

When ClamAV is not enough

If you want continuous protection with no manual scans, use the antivirus component already present in Windows or a commercial product with real-time monitoring and behavioural detection. ClamAV does not provide web filtering, ransomware rollback or exploit protection. Its value is being free, auditable, scriptable and widely deployed on the server side, which is why administrators who already run it elsewhere often keep a Windows install for checking files before they are moved or shared.