How to Detect and Remove Malware with ClamAV on Kali Linux

🛡️ What is ClamAV and why use it?

ClamAV is a free, open-source antivirus tool that runs on Linux. It is used to scan files and folders for viruses, trojans, and other malware. Because Kali Linux is often used for security testing, knowing how to use ClamAV is an important skill for every cybersecurity student.

In this lab, we will not use real malware. Instead, we will use the EICAR test file. This is a small text string that every antivirus in the world is built to detect. It is completely safe — it cannot harm your computer — but it lets us test that ClamAV is working properly.

1Install ClamAV

Open a terminal in Kali Linux and run the following commands one by one:

sudo apt update
sudo apt install clamav clamav-daemon -y

When I first ran this command, I got a "404 Not Found" error because my package list was out of date. If this happens to you, do not worry — see the troubleshooting section below.

After running sudo apt update again, the installation worked correctly and started downloading the packages:

Update the virus database

After installation, we need to download the latest virus signatures. The ClamAV daemon must be stopped first, otherwise the update will fail with a "lock" error:

sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam
clamscan --version

2Create a test folder and two files

Now we will create a new folder for our lab work, then make two files inside it: one fake virus, and one normal clean file.

mkdir ~/clamav-lab
cd ~/clamav-lab

Create the fake virus file (EICAR)

Type this command exactly as shown. The text inside the quotes is the official EICAR test string:

echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > fakevirus.txt

Create the clean file

echo "This is a normal clean file for testing." > cleanfile.txt
ls

⚠️ Important: The EICAR string is the only safe way to test antivirus software. Never download real malware from the internet for testing — it can harm your computer and is illegal in many countries.

3Scan the folder

Now we ask ClamAV to scan the whole folder:

clamscan ~/clamav-lab

ClamAV will take about 30 seconds to load its database, then check every file. You will see:

• cleanfile.txt: OK — the clean file passed.
• fakevirus.txt: Eicar-Signature FOUND — the test virus was caught.
• Infected files: 1 in the summary at the bottom.

4Remove or quarantine the infected file

ClamAV gives us two safe ways to handle an infected file:

Option A — Delete it

clamscan --remove ~/clamav-lab

Option B — Move it to a quarantine folder (safer)

This is the option I used in the lab. We make a new folder called quarantine, then tell ClamAV to move any infected files there instead of deleting them. This is safer because you can study the file later if needed.

mkdir ~/quarantine
clamscan --move=~/quarantine ~/clamav-lab

5Scan again to confirm

Finally, we run the scan one more time to make sure the folder is clean:

clamscan ~/clamav-lab
ls

This time we should see Infected files: 0 and only cleanfile.txt remaining in the folder.

🔧 Fixing the "404 Not Found" error

Kali Linux is a "rolling release", which means its packages change all the time. Sometimes the local package list points to an old version that has already been replaced. When this happens, apt install fails with a 404 error.

The fix is simple — refresh the package list and try again:

sudo apt update --fix-missing
sudo apt full-upgrade -y
sudo apt install clamav clamav-daemon -y

If that still does not work, clear the cache completely and refresh:

sudo apt clean
sudo rm -rf /var/lib/apt/lists/*
sudo apt update
sudo apt install clamav clamav-daemon -y