一、下载与安装
1. 下载 ClamAV RPM 在可联网的机器上，从官方 ClamAV 网站下载最新版 RPM 包：
wget https://www.clamav.net/downloads/production/clamav-1.5.4.linux.aarch64.rpm
2. 上传并安装
将下载的 RPM 包上传到目标服务器，并执行以下命令安装到指定目录：
rpm -ivh --prefix=/usr/local/clamav clamav-1.5.4.linux.aarch64.rpm
二、用户与目录配置
1. 添加 ClamAV 用户和用户组
groupadd clamav
useradd -g clamav clamav
2. 创建日志、病毒库与套接字目录
mkdir -p /usr/local/clamav/logs mkdir -p /usr/local/clamav/update mkdir -p /usr/local/clamav/socket
3. 创建日志文件并授权
touch /usr/local/clamav/logs/clamd.log touch /usr/local/clamav/logs/freshclam.log chown -R clamav:clamav /usr/local/clamav/logs chown -R clamav:clamav /usr/local/clamav/update chown -R clamav:clamav /usr/local/clamav/socket
三、配置 ClamAV
1. 配置 clamd.conf
复制示例配置文件并修改：
cp /usr/local/clamav/etc/clamd.conf.sample /usr/local/clamav/etc/clamd.conf vi /usr/local/clamav/etc/clamd.conf
主要修改内容：
#Example # 注释掉示例行 LogFile /usr/local/clamav/logs/clamd.log PidFile /usr/local/clamav/update/clamd.pid DatabaseDirectory /usr/local/clamav/update LocalSocket /usr/local/clamav/socket/clamd.socket TCPSocket 3310 MaxThreads 64
2. 配置 freshclam.conf
复制示例配置文件并修改：
cp /usr/local/clamav/etc/freshclam.conf.sample /usr/local/clamav/etc/freshclam.conf vi /usr/local/clamav/etc/freshclam.conf
主要修改内容：
#Example # 注释掉示例行 DatabaseDirectory /usr/local/clamav/update UpdateLogFile /usr/local/clamav/logs/freshclam.log PidFile /usr/local/clamav/update/freshclam.pid
将配置文件复制到系统目录：
cp /usr/local/clamav/etc/*.conf /usr/local/etc/
四、配置库文件路径
为了让 ClamAV 可以正确加载库文件，编辑 /etc/ld.so.conf 并追加：
/usr/local/clamav/lib64
然后更新配置：
ldconfig
启动会有个报错
[root@localhost update]# /usr/local/clamav/sbin/clamd LibClamAV Error: Failed to create a new code-signature verifier: Can't verify: Invalid certs directory '/usr/local/etc/certs': No such file or directory (os error 2) ERROR: Broken or not a CVD file
#解决方案
方法一：修改配置文件
编辑 clamd.conf 配置文件：
vim /usr/local/etc/clamd.conf
修改证书目录配置：
# 如果存在这行，直接修改路径
# 如果不存在，直接在文件末尾加上这行
SignedDbs /usr/local/clamav/etc/certs/clamav.crt
保存并退出，然后重新启动 clamd:
/usr/local/clamav/sbin/clamd
方法二：复制文件到程序预期的目录
既然程序非要去找 /usr/local/etc/certs，我们就手动把这个文件放进去
创建缺失的目录：
mkdir -p /usr/local/etc/certs
把证书文件复制过去：
cp /usr/local/clamav/etc/certs/clamav.crt /usr/local/etc/certs/
重新启动：
/usr/local/clamav/sbin/clamd
五、离线病毒库安装
下载病毒库文件并上传至 /usr/local/clamav/update
https://cloud.tencent.com/developer/tools/blog-entry?target=https%3A%2F%2Fdatabase.clamav.net%2Fmain.cvd&objectId=2585072&objectType=1&contentType=rich
https://cloud.tencent.com/developer/tools/blog-entry?target=https%3A%2F%2Fdatabase.clamav.net%2Fdaily.cvd&objectId=2585072&objectType=1&contentType=rich
https://cloud.tencent.com/developer/tools/blog-entry?target=https%3A%2F%2Fdatabase.clamav.net%2Fbytecode.cvd&objectId=2585072&objectType=1&contentType=rich
服务器如果可联网，也可以使用 freshclam 更新病毒库：
/usr/local/clamav/bin/freshclam
六、启动与使用
/usr/local/clamav/sbin/clamd
netstat -tuln | grep 3310
使用 clamscan 扫描
# 扫描指定目录 /usr/local/clamav/bin/clamscan -r /home # 后台运行扫描 nohup /usr/local/clamav/bin/clamscan -r / > clamscan.log 2>&1 &
七、设置开机自动更新
1. 守护进程模式启动 freshclam
/usr/local/clamav/bin/freshclam --daemon
2. 加入开机启动脚本
chmod +x /etc/rc.d/rc.local echo "/usr/local/clamav/bin/freshclam --daemon" >> /etc/rc.d/rc.local echo "/usr/local/clamav/sbin/clamd" >> /etc/rc.d/rc.local
3. 定时任务更新病毒库
编辑 crontab：
crontab -e
添加定时任务，例如每天凌晨 3 点更新：
0 3 * * * /usr/local/clamav/bin/freshclam
八、卸载 ClamAV
rpm -e clamav
