clamscan(1)
Scan files and directories for malware using the ClamAV antivirus engine.
Synopsis
clamscan [OPTION]... [FILE/DIR]...Description
clamscan is a command-line antivirus scanner that uses the ClamAV virus database to detect malware, trojans, and other threats in files and directories. It scans local files and can be run on-demand or integrated into automated security workflows.
By default, clamscan only reports infected files and returns an exit code indicating the scan result. It does not remove infected files unless explicitly configured, making it safe for initial threat detection.
Common options
| Flag | What it does |
|---|---|
-r, --recursive | Scan directories recursively, including all subdirectories |
-i, --infected | Print only infected files instead of all files scanned |
--remove | Remove infected files automatically (use with caution) |
--move=DIR | Move infected files to specified directory instead of removing |
-z, --allmatch | Continue scanning a file after finding a match (detect multiple threats) |
--max-filesize=SIZE | Skip files larger than specified size (e.g., 50M, 2G) |
--log=FILE | Write scan report to specified log file |
-v, --verbose | Display detailed information during scanning |
--database=FILE | Use custom virus database file instead of default |
--exclude-dir=DIR | Skip specified directories during recursive scan |
--phishing-sigs | Enable detection of phishing signatures and URLs |
--bell | Ring bell on virus detection |
Examples
Recursively scan all files in documents directory and subdirectories
clamscan -r /home/user/documentsScan ZIP files in downloads folder, showing only infected files
clamscan -i /tmp/downloads/*.zipRecursively scan web directory and move any infected files to quarantine
clamscan -r --move=/quarantine /var/wwwScan home directory recursively and save detailed report to log file
clamscan -r --log=/var/log/clamav-scan.log /homeScan with verbose output, skipping files larger than 100MB
clamscan --max-filesize=100M -v /dataScan entire filesystem recursively, excluding system pseudo-filesystems
clamscan -r --exclude-dir=/proc --exclude-dir=/sys /Scan a single email file for embedded threats
clamscan email.emlScan temp directory detecting multiple threats per file, showing only infected
clamscan -r --allmatch -i /tmp