Clam AntiVirus (ClamAV) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, OSF (Tru64) and Solaris. As of version 0.97.5, ClamAV builds and runs on Microsoft Windows. Both ClamAV and its updates are made available free of charge. One of its main uses is on mail servers as a server-side email virus scanner. Sourcefire, developer of intrusion detection products and the owner of Snort, announced on 17 August 2007 that it had acquired the trademarks and copyrights to ClamAV from five key developers. Upon joining Sourcefire, the ClamAV team joined the Sourcefire Vulnerability Research Team (VRT). In turn, Cisco acquired Sourcefire in 2013. The Sourcefire VRT became Cisco Talos, and ClamAV development remains there. Features ClamAV includes a command-line scanner, automatic database updater, and a scalable multi-threaded daemon running on an anti-virus engine from a shared library. The application features a Milter interface for sent mail and on-demand scanning. It recognizes: ZIP, RAR, Tar, Gzip, Bzip2, OLE2, Cabinet, CHM, BinHex, and SIS formats Most mail file formats ELF and Portable Executable (PE) files compressed with UPX, FSG, Petite, NsPack, wwpack32, MEW, and Upack, or obfuscated with SUE, Y0da Cryptor. Office Open XML file formats, HTML, Rich Text Format (RTF) and Portable Document Format (PDF). The ClamAV virus database is updated at least every four hours and as of 10 February 2017 contained over 5,760,000 virus signatures with the daily update Virus DB number at 23040. Effectiveness ClamAV was tested against other antivirus products on Shadowserver. In 2011, Shadowserver tested over 25 million samples against ClamAV and numerous other antivirus products. Out of the 25 million samples tested, ClamAV scored 76.60% ranking 12 out of 19, a higher rating than some much more established competitors. In the 2008 AV-TEST comparison of antivirus tools, ClamAV scored poorly in on-demand detection, avoiding false positives, and rootkit detection. In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28%. In 2022 Splunk conducted an efficacy study involving ~400,000 malware samples sourced from MalwareBazaar. The study concluded ClamAV is 59.94% effective overall at detecting commodity malware. Unofficial databases The ClamAV engine can be reliably used to