ClamAV for OS X

Reviewed by Bil Hays 04/25/2012

Clamav is an opensource antivirus application that is available for most operating systems. If you cannot or wish not to use the Symantec antivirus software available from ITS, clamav is a good alternative. In 2012 ITS began to support Clamav.

Macintosh Systems

Download the ClamXav package and start the application after moving it to the application's folder.

If you are using 10.6 or later, that's all you need to do. Users of earlier versions should also install the plugin.

Manual scans

To run a manual scan, just select the directory you'd like to scan. Scanning your entire home directory can take a fairly long time. If any viruses are found, you can ctrl-click on them and choose delete to get rid of them. If you keep email for offline reading, you may find a number of infected files in your mail directory.

Setting up automated protection

In the General Preferences, enable Update virus definitions on launch. This will make sure that when you start the application you'll have the most up to date definitions.

You will want to set up a regular scan. For desktop systems that are left on overnight, scanning early in the morning is the best option for most users. If you're on a laptop or shutdown your machine, pick a time that the machine is likely to be running and your work load is likely to be light, since scanning for viruses can load your machine down a bit.

You should also enable Sentry, as this will enable live scans of files as they are modified. In this example, I am scanning the Users directory, Applications, and Library folders.

One thing to keep in mind about this option is that if any directories on your machine sync to other directories, you may wind up quarantining the same files over and over. For example, if you use Mail.app to access mail on an imap server and you tell it to keep copies of attachments locally for offline reading, clamav will find those files, quarantine them, and then find them and quarantine them again after Mail.app resyncs the local copies from the imap server.

Finally, none of this will do anything about infected files. If you are like most people, you probably don't check your logs every day, so we'll want to setup an quarantine folder and move any infected files there. Do not enable this option until after you've run a few manual scans, however, as you'll want to see what the program will find before allowing it to do anything.