How to Install ClamAV Antivirus on Ubuntu (Step-by-Step Guide)

To ensure your system is protected, install ClamAV Antivirus on Ubuntu. Install ClamAV on Ubuntu might sound like something only security geeks do, but honestly it’s one of those quick setups that can save you a headache later. Sure, Linux isn’t flooded with viruses like Windows, but that doesn’t mean it’s untouchable. One bad script or a shady file on your server is enough to mess things up. This is why you need to install ClamAV Antivirus on Ubuntu.

That’s where ClamAV comes in. It’s free, open-source, and has been around for years. Nothing fancy, but it does the job: scanning for Trojans, rootkits, and random junk that shouldn’t be on your machine. In this guide I’ll walk through installing ClamAV on Ubuntu, updating its database, and running a few simple scans you’ll probably use most of the time. Part of this guide focuses on how to install ClamAV Antivirus on Ubuntu properly.

Before we dive deeper, here’s a real example from my own experience. A while back I was troubleshooting a client’s Ubuntu mail server that suddenly started acting weird high load, random processes. Poking around the server, I noticed a PHP file hiding inside /tmp. Looked innocent at first, but when I ran ClamAV on it, bam Trojan detected. That was the moment I realized even on Linux, you can’t just assume you’re safe. Since then, I don’t spin up a server without ensuring ClamAV Antivirus is installed on Ubuntu.

Step 1: Connect to Your Ubuntu Terminal

Fire up a terminal window, or SSH into your Ubuntu server if you’re working remotely.

Step 2: Update System Packages

Before installing any software, update your system packages to make sure everything is up to date:

sudo apt-get update

Step 3: Install ClamAV Antivirus

Now install ClamAV by running:

sudo apt-get install clamav

Once the install finishes, ClamAV is up and running on Ubuntu, ready for its first scan.

Update the ClamAV Database

After installing, the very first thing you should do is refresh ClamAV’s virus database. If you skip this step, ClamAV won’t recognize any threats. Just run:

sudo freshclam

This pulls the latest virus signatures from ClamAV’s servers, so your scans are actually useful.

Scanning with ClamAV

Now for the fun part—scanning your system. Depending on what you want, here are a few commands you’ll probably use:

Quick check of your home folder:

clamscan

Scan a specific folder (say /tmp):

clamscan -r /tmp

Go all in and scan everything:

clamscan -r /

Only show infected files (skip the clean ones):

clamscan -r -i /tmp

Automatically remove bad files while scanning:

clamscan -r --remove /tmp

Not sure what else it can do?

clamscan --help

Do You Really Need ClamAV on Ubuntu?

A lot of people think Linux doesn’t need antivirus, and to some extent that’s true—it’s less targeted than Windows. But if you’re running a mail server, sharing files with others, or handling sensitive data, ClamAV can be a real safety net. Install ClamAV Antivirus on Ubuntu to catch junk before it spreads, which is exactly what you want in a production environment.

Common Issues and Fixes

I’ve also had a few headaches with ClamAV that might sound familiar if you’ve used it for a while:

Freshclam won’t update

One time I spent half an hour wondering why the database refused to update, only to realize outbound traffic on port 80 was blocked by the datacenter’s firewall. Running sudo freshclam -v usually gives you a hint about what’s wrong, so don’t skip that.

Scans running forever

On a backup server, I once kicked off a full scan and it literally ran all night. The culprit? Huge ISO images and archives I didn’t even care about scanning. Adding –max-filesize or excluding certain directories shaved it down from hours to minutes.

False positives

Rare, but it happens. I had a harmless Python script get flagged once ClamAV thought it was malicious because of a string inside it. In the end, I fixed it by making ClamAV skip the file altogether. If you’re 100% sure it’s safe, you can also submit it to the ClamAV team so they don’t mark it in future updates.

Conclusion

And that’s it ClamAV on Ubuntu is up and running. Took just a couple of minutes, right? It’s not the kind of tool you’ll use every single day, but when you need to double-check a folder or scan a whole server after uploading random files, it really comes in handy.

I don’t see it as a “replace your brain” type of security you still need updates, common sense, and maybe a firewall in place but ClamAV is a nice extra layer. Free, open-source, light on resources. If you’re running a mail server or handling files from clients, it’s a no-brainer. Otherwise, think of it as a seatbelt: most of the time you won’t notice it, but when you do, you’ll be glad it’s there.