Published October 26, 2026
While Ubuntu is inherently secure thanks to its strict permission architecture, scanning files for potential malware is essential—especially when downloading files from external sources or sharing files with Windows users.
ClamAV is the open-source standard antivirus engine for Linux designed for detecting trojans, viruses, malware, and other malicious threats. Here is a complete guide on how to install ClamAV, scan downloaded files, automate a weekly system scan via terminal scripts, and handle detected threats.
ClamAV is included in the official Ubuntu repositories and can be installed directly from the terminal.
Open your terminal (Ctrl + Alt + T) and run:
Before scanning, update the virus database to detect the latest threats.
Stop the background update service temporarily:
To verify that a freshly downloaded file is safe before opening it, you can run a targeted scan on your Downloads folder or individual files.
Scan a Single File:
To scan all files in your Downloads directory and show only infected files in the output, use the -r (recursive) and --infected flags:
You can set up a simple Bash script and schedule it with cron so your system runs a regular weekly virus scan in the background.
Step 1: Create the Scan Script
Open the terminal and create a new script file:
Press Ctrl + O and Enter to save, then Ctrl + X to exit.
Open the root crontab configuration:
Save and close the file. Your system will now perform an automated scan every week and save the results to /var/log/clamav/weekly_scan.log.
Press Ctrl + O and Enter to save, then Ctrl + X to exit.
If ClamAV flags a file as infected, do not open or execute it. Here are the steps to isolate or remove it safely:
Option 1: Quarantine the Infected File
Moving the file to a quarantine directory prevents accidental execution while allowing you to inspect it:
If you are confident that the infected file is malicious and not a critical system file, you can tell ClamAV to remove it upon detection:
Warning: Be cautious when using --remove on system-wide scans to avoid accidentally deleting critical system or personal files flagged by a false positive. Quarantine is always the safer first step.
Summary
Using ClamAV on Ubuntu gives you complete control over your file security. By scanning new downloads immediately and keeping a weekly automated terminal script running in the background, your Ubuntu environment stays clean, safe, and protected.