Antivirus for Linux: Ubuntu, Fedora, Debian, Arch and beyond

"Linux doesn't get viruses" is one of those half-truths that ages badly. It's true that a well-kept desktop running only packages from its distro's repositories is a hard target — there's no auto-run, no macro-laden email attachments opening themselves, and a package manager instead of random .exe downloads. But "hard target" is not "no target," and the gap between the two is exactly where people get hurt.

This is a practical guide to antivirus on Linux — when it actually matters, how to set up ClamAV on Ubuntu, Fedora, Debian and Arch, and how Bulwark turns the whole thing into one click with a scanner built in.

Do you need antivirus on Linux?

Honestly? It depends on what the machine does. You genuinely benefit from malware scanning when:

• You run a server, or share files. A Linux mail, web or file server is a common carrier of Windows malware — it won't infect the Linux box, but it'll happily pass an infected attachment to a coworker who's on Windows. Scanning at the door is basic hygiene.
• You download and run things outside the package manager. Random install scripts piped into sh, cracked software, game mods, an .AppImage from a forum, a "helper" binary a tutorial told you to chmod +x. Linux malware is real and growing, and most of it arrives exactly this way.
• You're a developer. Your machine holds SSH keys, cloud credentials, source code and — now — AI-assistant transcripts full of secrets. That's a high-value target, and supply-chain malware in npm, PyPI and container images is one of the fastest-growing threat categories there is.
• You want peace of mind. A quick signature scan is cheap insurance, and "I checked" beats "I assumed."

If your machine is a locked-down desktop that only ever installs from the official repos, the honest answer is that configuration matters far more than a virus scanner — an exposed SSH service or a world-writable cron job will get you long before a virus does. That's why Bulwark does both.

Installing ClamAV, per distro

ClamAV is the open-source, cross-platform antivirus engine most Linux malware scanning is built on. Installing it is a one-liner — it's just different on every distro, which is half of why people never bother:

Ubuntu / Debian

sudo apt update && sudo apt install clamav clamav-daemon
sudo freshclam          # download the latest signature database

Fedora / RHEL

sudo dnf install clamav clamav-update
sudo freshclam

Arch

sudo pacman -S clamav
sudo freshclam

openSUSE

sudo zypper install clamav
sudo freshclam

Then a scan is clamscan -r --infected ~/Downloads, or clamdscan against the daemon for speed. That works — but you have to remember the commands, keep freshclam current, read a wall of terminal output, and know how to tell a real detection from a false positive.

Where Bulwark comes in

Bulwark uses the same ClamAV engine, and makes the tedious parts disappear:

• Live progress. A real scan of a home directory can take minutes. Bulwark streams per-file progress so you can watch it work, instead of staring at a frozen terminal.
• It tells you if ClamAV is even there. No engine installed? Bulwark shows you the exact install command for your distro — the same per-distro one-liners above — instead of a cryptic error.
• It checks the database is fresh. An antivirus with month-old signatures is theatre. Bulwark reports the installed engine and database version and how old it is, so a stale database is a finding, not a silent gap.
• Detections in plain language. A signature match names the file and the threat, next to a clear action — not a raw log line you have to decode.

And because it's the same app that scans your configuration and your AI assistants, "am I safe?" becomes one screen and one button instead of five different tools.

Antivirus is necessary, not sufficient

Here's the part most "Linux antivirus" pages leave out: on a Linux machine, the way in is usually a misconfiguration, not a virus. Password-based SSH left on. Root login permitted. A sudoers rule that's too broad. A private key sitting in plaintext. Unprivileged BPF left enabled. A secret pasted into a Claude Code transcript that's now in a synced folder.

None of those are things a virus scanner looks at — and all of them are things Bulwark checks, sorts by how much they matter, and offers to fix for you. Malware scanning is one pillar; it sits next to configuration hardening and AI-assistant security, so you're covered against the whole picture, not just the part with a signature.

Get started

Download Bulwark → · Do you really need antivirus on Linux?

Free, open-source (Apache-2.0), and fully local — no account, no telemetry, on Ubuntu, Fedora, Debian, Arch and anything else that runs a modern Linux.