ClamAV

ClamAV is an open-source antivirus engine designed for detecting trojans, viruses, malware, and other malicious threats. Originally developed by Tomasz Kojm in 2001 and acquired by Sourcefire (later acquired by Cisco in 2013), ClamAV has become the de facto standard antivirus solution for Unix-based systems, email gateways, file servers, and cloud infrastructure. Unlike commercial antivirus products that rely on proprietary detection engines, ClamAV provides a fully open-source (GPLv2) detection platform that can be freely deployed, customized, and integrated into larger security workflows. Key features include: a multi-threaded scanning daemon (clamd) capable of scanning thousands of files per second on multi-core systems, a command-line scanner (clamscan) for manual and scripted file scanning, on-access scanning (clamonacc) that monitors file system events in real-time and scans files as they are accessed, support for scanning archives (ZIP, RAR, 7z, TAR, GZ, BZ2, and many others) with configurable recursion depth and file size limits, email scanning support (parsing and scanning MIME-encoded emails, including attachments), a regularly updated signature database containing over 3 million virus signatures maintained by the Cisco Talos Intelligence Group and community contributors, support for custom signatures via the ClamAV Signature Language (allowing organizations to write their own detection rules for specific threats), support for Bytecode signatures (LLVM-based bytecode signatures for complex detection logic that cannot be expressed in simple pattern matching), a FreshClam daemon for automatic signature database updates with configurable update intervals, and milter integration for Sendmail and Postfix email servers. As of 2026, ClamAV has over 4,800 stars.