ClamAV
FreeAn open-source antivirus engine that never pops up, upsells or uploads your files
An open-source virus scanning engine maintained by Cisco Talos. It is mainly used for on-demand scanning on servers, mail gateways and file shares, and also works on the desktop for manually checking suspicious files. No resident pop-ups, no upgrade prompts, and the signature database is free and updated daily.
Why we picked it
Free antivirus is one of the dirtiest corners of the software industry: resident pop-ups announcing "3 risks found, upgrade to Pro to fix", bundled browsers and "system boosters", inflated detection counts, and files quietly uploaded to the cloud for "analysis".
ClamAV is a different animal. 7,130 stars, GPL-2.0, maintained by Cisco's Talos security team, and never intended as a consumer desktop product — it is an engine, and a great many mail servers, file servers, NAS boxes and gateways use it to scan traffic.
That shapes its character: no pop-ups, no commercial edition, no upselling. It scans what you point
it at and prints the result. The signature database is entirely free and updates daily via the
freshclam command.
Where it genuinely fits:
- Servers and NAS boxes: scanning uploads and shared directories. The antivirus packages built into NAS systems such as Synology's are ClamAV underneath.
- Mail gateways: scanning attachments alongside Postfix or Exim, its most classic role.
- Manually checking suspicious files on a desktop before opening something of unclear origin.
- Cross-checking another machine — scanning a Windows partition for malware from Linux is a job it suits well.
The limitations matter and must be stated:
- It is not real-time protection for Windows desktops. A Windows build exists, but it has none of the real-time monitoring, behavioral analysis or ransomware protection that mainstream security suites provide. Windows users should mainly rely on the built-in Microsoft Defender — free, real-time, deeply integrated, consistently decent in independent testing, and equally free of ads and upsells. Installing a third-party free antivirus is usually a downgrade rather than an upgrade.
- Detection rates trail commercial engines. It relies primarily on signature matching, which limits it against novel threats. Poor as a sole defense, good as a supplementary scanner.
- It needs network access to update signatures, which is why it carries no offline badge.
Verdict: the standard choice on servers, mail gateways and NAS boxes. On a Windows desktop, use Defender properly and keep ClamAV as a manual second opinion.