How to Set Up ClamAV Antivirus Scanning in Webmin (Complete 2026 Guide)

FreshClam needs to run before clamd starts or it will fail due to missing signatures:

systemctl stop clamav-freshclam 2>/dev/null
systemctl stop clamav-daemon 2>/dev/null

freshclam

This downloads the latest virus definition databases (main.cvd, daily.cvd, bytecode.cvd) from ClamAV's servers. The initial download can take 1-5 minutes depending on bandwidth. You should see output confirming each database was updated.

systemctl enable clamav-freshclam --now
systemctl enable clamav-daemon --now

On RHEL-based systems, the service names may be clamd@scan and clamav-freshclam.

systemctl status clamav-daemon
clamdscan --version

# Log settings
LogFile /var/log/clamav/clamav.log
LogTime yes
LogSyslog yes

# Performance limits
MaxThreads 4
MaxDirectoryRecursion 20
MaxFileSize 25M
MaxScanSize 100M

# Quarantine directory
MoveInfected /var/quarantine

# Scan settings
ScanPE yes
ScanELF yes
ScanOLE2 yes
ScanHTML yes
ScanArchive yes
DetectPUA yes

mkdir -p /var/quarantine
chmod 700 /var/quarantine
chown clamav:clamav /var/quarantine

Add exclusions for system directories and large data directories that don't contain web-accessible files:

ExcludePath ^/proc
ExcludePath ^/sys
ExcludePath ^/dev
ExcludePath ^/run
ExcludePath ^/var/lib/mysql

systemctl restart clamav-daemon

clamscan -r --infected --remove=no /home/username/public_html/

-r scans recursively. --infected prints only infected files. --remove=no reports but does not delete (recommended for the first scan — review findings before enabling auto-removal).

clamscan -r --infected --remove=no /home/ 2>/dev/null | tee /tmp/clamav-scan-$(date +%Y%m%d).log

The results are saved to a dated log file in /tmp/.

When clamd is running, clamdscan (with the d) submits scan jobs to the daemon instead of loading the virus database into memory per invocation — significantly faster for large directories:

clamdscan --multiscan --fdpass /home/ 2>/dev/null | tee /tmp/clamdscan-$(date +%Y%m%d).log

cat > /usr/local/bin/clamav-scan.sh << 'SCANEOF'
#!/bin/bash
LOGFILE="/var/log/clamav/scan-$(date +%Y%m%d).log"
EMAIL="admin@yourdomain.com"
SCAN_DIR="/home"

echo "ClamAV Scan Report - $(date)" > "$LOGFILE"
echo "=============================" >> "$LOGFILE"

clamdscan --multiscan --fdpass "$SCAN_DIR" >> "$LOGFILE" 2>&1

INFECTED=$(grep -c "FOUND" "$LOGFILE" 2>/dev/null || echo 0)

if [ "$INFECTED" -gt 0 ]; then
    mail -s "[ALERT] ClamAV found $INFECTED infected file(s) on $(hostname)" "$EMAIL" < "$LOGFILE"
else
    mail -s "[OK] ClamAV scan clean on $(hostname)" "$EMAIL" < "$LOGFILE"
fi
SCANEOF
chmod +x /usr/local/bin/clamav-scan.sh

echo "0 2 * * * root /usr/local/bin/clamav-scan.sh" > /etc/cron.d/clamav-scan

/usr/local/bin/clamav-scan.sh
cat /var/log/clamav/scan-$(date +%Y%m%d).log

Go to wbmclamav.esaracco.fr and download the latest release as a .wbm.gz file.

Log in to Webmin → Webmin → Webmin Configuration → Webmin Modules → Install Module → upload the .wbm.gz file → click Install Module.

After installation, ClamAV appears under Webmin → System → ClamAV Antivirus. You can configure update schedules, trigger manual scans, view the quarantine directory, and search the virus database — all without SSH.

grep "FOUND" /var/log/clamav/scan-$(date +%Y%m%d).log

Note the paths. If multiple files in the same directory are infected, or if the same signature appears in multiple accounts, the server may have been compromised at the system level rather than just a single user's files.

clamscan -r --move=/var/quarantine /path/to/infected/directory/

Moving preserves the evidence if you need to determine how the infection occurred. Always review quarantined files before permanently deleting them.

Check FTP logs (/var/log/vsftpd.log), SSH logs (/var/log/auth.log), and web access logs for unusual activity around the time of infection.

# Search for web-accessible PHP files with exec or system calls
find /home -name "*.php" -exec grep -l "eval(base64" {} \;
find /home -name "*.php" -exec grep -l "system(\$_" {} \;

For Webmin-managed servers where malware detection and incident response need to be part of a broader managed security posture, CloudHouse's managed server service includes scheduled ClamAV scanning, malware alerting, and incident response support.