ClamAV, Antivirus Transparency and Trust

Antivirus is a position of trust

A security product may inspect private documents, browser downloads and email, and may run with elevated permissions. Its update channel can change code on the computer. Choosing a scanner therefore means choosing who may handle sensitive information and how that access is controlled. A familiar brand or a strong detection score answers only part of that question.

What meaningful transparency looks like

Ask what information leaves the device: file hashes, filenames, diagnostic logs or full samples. Check whether sample submission is optional, how long data is retained, and which organisation receives it. A useful privacy policy explains these choices clearly. For a business, record the answers before enabling cloud features on systems containing customer data.

Open source helps scrutiny

Published source code allows independent inspection and discussion of fixes. It does not guarantee that someone has reviewed every component, that a downloaded binary matches the source, or that the software has no vulnerabilities. Our practical approach is to look for a maintained project, clear security notices, trustworthy packages and a documented update process. Transparency is a way to make trust testable, rather than a promise of perfect protection.

Where ClamAV fits

ClamAV is a GPLv2 antivirus toolkit provided by Cisco, particularly associated with mail gateways. It includes command-line scanning, a daemon and signature updates. It is useful for inspecting attachments and uploads, but is not a complete endpoint security suite. On Windows, installing the official package does not supply continuous on-access protection. Follow our Windows MSI installation guide.

Kaspersky in Western countries: distinguish the decisions

Kaspersky is a Russian-origin security vendor. Germany’s BSI warned on 15 March 2022 that its antivirus products should be replaced, citing the risks around a highly privileged product in the geopolitical situation. In the United States, the Commerce Department announced restrictions in June 2024 covering provision of specified products and services; signature and code updates for US users were prohibited from 29 September 2024. These are different national measures, not a single blanket ban across the Western world. Consult the relevant authority for your jurisdiction and deployment.

The manufacturer’s position matters too

Kaspersky disputes the basis of the US decision and describes its Global Transparency Initiative, including controlled source review through transparency centres. These are the company’s claims and verification arrangements; they should be assessed alongside the authorities’ stated concerns. Access to source under a review programme is different from an open-source licence. Neither a vendor’s nationality alone nor its own marketing establishes that a particular installation has been compromised.

Security in daily operation

Keep the operating system, applications and scanner updated. Use ordinary user accounts for everyday work, maintain recoverable backups and treat unexpected attachments cautiously. With any scanner, record update failures and files that could not be examined. An encrypted archive or a processing limit can leave content uninspected. A clean result is evidence about one scan, not a guarantee that opening a file is safe.

For mail gateways and upload portals

Put scanning at a defined point before delivery or publication. Document what happens if the scanner times out: “unavailable” must remain distinct from “clean”. Keep uploaded files outside the public web directory while checks run, and apply size and resource limits. Review suspicious files before deletion and avoid sending confidential samples to outside services without authorisation. Good administration combines the scanner with access controls and accountable handling of exceptions.