Help › Security
Malware scanning with ClamAV
Free scheduled and on-demand malware scans on your Macs and Linux machines with ClamAV, and what they do and don't protect against.
bananana.dev can scan your Macs and Linux machines for known malware at no cost, using ClamAV, the open-source scanner from Cisco. It's your choice: nothing is installed unless you turn it on.
Turning it on
- Open the device on the Nodes page, then its Security tab.
- Under Malware scanning, choose Turn on. The device installs ClamAV and downloads its signatures, which takes a few minutes.
- To add it to all your Macs and Linux machines, open Malware scanning on the Nodes page and choose Add it to every Mac and Linux device. Each one gets it when it's next online.
It needs the node's terminal feature, because it runs as a job on the device. On Linux it comes from your distribution's own packages, so it gets their security updates; on a Mac it comes from Cisco's official release, checked against a pinned checksum. Docker devices aren't covered.
Scans
Every device with ClamAV gets a quick scan each week, or each day, or only when you ask: choose under Scheduled quick scan. Signatures are updated just before each scan.
- Quick scan: the places malware usually lands, such as people's home folders and temporary folders.
- Full scan: every local disk. It can take hours.
Scans run in the background at low priority and need about 2 GB of free memory while they run. The result appears on the Security tab when the scan finishes.
When it finds something
You get an alert, and the Security tab lists each file and what it matched. ClamAV only reports: nothing is deleted or moved. Some matches are false alarms, so check a file before you remove it. Every scan is recorded on the Logs page.
Removing it
On the device's Security tab, choose Remove ClamAV. If you used Add it to every Mac and Linux device, turn that off first, or it comes back.