Our antivirus signatures for ClamAV: statistics, effectiveness and comparison
Every day, thousands of malware samples circulate on the Internet. SecuriteInfo.com actively fights this malware
to make the Internet a safer place. This page brings together the daily statistics of our antivirus signatures for
ClamAV, the results of testing them against malware actually collected from hacked websites, and a
point-by-point comparison between ClamAV alone and ClamAV enhanced with our signatures.
Among the weapons against malware that we make available to our customers, we offer mail filtering, a free DNS service, and also additional antivirus signatures for ClamAV.
ClamAV is Cisco's open source antivirus, which runs on every Linux and Unix system, and which also has ports for Windows (ClamAV and ClamShield) and Mac (ClamXAV).
Our antivirus signatures simply add to the official ClamAV signatures. As a result, ClamAV's malware detection is far better, which makes ClamAV the best Linux antivirus in the world. Our antivirus signatures must therefore be as effective as possible, so that protection across the Internet is the best it can be.
It is therefore fair to ask a few questions:
In the interest of transparency, we publish the following figures every day:
ClamAV is an excellent antivirus engine, free and open source. Our signatures do not replace it: they add to its official databases, without any duplicates. Here is, criterion by criterion, what this addition changes.
Internet users generally believe that virus infections come mainly from attachments sent by email, or from files they deliberately download. Yet there is a far less visible danger: simply visiting a compromised website. The site may be perfectly legitimate and have been hacked without its owner's knowledge; the malicious code is planted there, then served to visitors. Infected websites therefore represent a very real risk.
To measure this risk, we continuously collect the files planted on hacked websites, then we scan them with ClamAV: first with the official databases only, then adding our signatures. Here are the results for the current collection.
Ranking of the signatures triggered most often on the collection. The YARA.SecuriteInfo_* and SecuriteInfo.com.* signatures are ours; the Sanesecurity.* signatures come from another unofficial database that is also well established.
The Basic plan is free. Installation comes down to adding a few URLs to your freshclam.conf: no changes to ClamAV are required.
ClamAV is copyright © Cisco Systems, Inc.
Did you enjoy this article? Here are a few suggestions you should like:
Inscrivez-vous à notre lettre d'information pour vous tenir au courant de nos actualités et de nos dernières trouvailles.
Are our antivirus signatures for ClamAV effective?
Among the weapons against malware that we make available to our customers, we offer mail filtering, a free DNS service, and also additional antivirus signatures for ClamAV.
ClamAV is Cisco's open source antivirus, which runs on every Linux and Unix system, and which also has ports for Windows (ClamAV and ClamShield) and Mac (ClamXAV).
Our antivirus signatures simply add to the official ClamAV signatures. As a result, ClamAV's malware detection is far better, which makes ClamAV the best Linux antivirus in the world. Our antivirus signatures must therefore be as effective as possible, so that protection across the Internet is the best it can be.
It is therefore fair to ask a few questions:
- How many signatures are published by SecuriteInfo.com?
- How many signatures are generic?
- How many malware samples are detected by the generic signatures?
- How many malware samples are detected with all of the SecuriteInfo.com signatures?
In the interest of transparency, we publish the following figures every day:
11 655 559 malware samples detected by our signatures
Non-generic antivirus signatures
4 555 741
one signature = one malware sample
Generic antivirus signatures
110 735
one signature = one malware family
Total antivirus signatures
4 666 476
published by SecuriteInfo.com
Malware detected by the generic signatures
7 099 818
that is 64 malware samples on average per generic signature
Key takeaway: it is our generic signatures that make the difference. With only
110 735 generic signatures, we cover
7 099 818 malware samples: this is what makes it possible to detect variants that
did not yet exist when the signature was written.
ClamAV alone or ClamAV plus the additional signatures from SecuriteInfo.com?
ClamAV is an excellent antivirus engine, free and open source. Our signatures do not replace it: they add to its official databases, without any duplicates. Here is, criterion by criterion, what this addition changes.
| Criterion | ClamAV alone official Cisco Talos signatures |
ClamAV + SecuriteInfo.com official databases + our signatures |
|---|---|---|
| Antivirus engine | ClamAV, open source, free | The very same ClamAV engine: nothing to replace |
| Additional malware signatures | — | 4 666 476 additional signatures1, including 110 735 generic ones |
| Extra malware coverage | — | 11 655 559 additional malware samples detected1 |
| Duplicates between the two databases | — | None: as soon as a malware sample is covered by an official signature, we remove ours |
| Detection on malware from hacked websites | ✗ 0 % (6/1 356 malware samples)2 | ✓ 99 % (1 349/1 356 malware samples)2 |
| Update frequency | Official database usually published once or twice a day | ✓ Every hour, built from the malware captured on the same day |
| 0-day malware | Covered once the official signature is published | ✓ Signatures produced a few minutes after the malware is captured |
| Linux / ELF threats (Mirai, IoT botnets, miners) | Limited coverage | ✓ Reinforced: it is the 1st family in our collection (see the Top 50) |
| Webshells, malicious JavaScript and PHP | Partial | ✓ Dedicated signatures for web threats |
| Phishing | Official daily database, basic coverage | ✓ More than 90 % of campaigns detected |
| Spam | ✗ Not covered | ✓ Anti-spam signatures delivered in addition to the malware signatures |
| Ransomware, trojans, stealers | Known families | ✓ Known families + recent variants through the generic signatures |
| Platforms | Linux, Unix, Windows (ClamWin), macOS (ClamXAV) | Identical: no additional constraints |
| Setup | Standard installation, freshclam | Add a few DatabaseCustomURL lines to freshclam.conf: no changes to ClamAV |
| Support | Community-based | ✓ Free support included, French vendor |
| Cost | Free | Free Basic plan, then Professional 29.90 €/year, Gold 99 €/year, Reseller 1 499 €/year |
Detection rate on malware collected from hacked websites
Share of the 1 356 malware samples in the collection that raise an alert. Same ClamAV engine, same files: only the signature databases differ.
0 %
ClamAV alone
6 / 1 356 malware samples
99 %
ClamAV + SecuriteInfo.com
1 349 / 1 356 malware samples
Test carried out with ClamAV 1.4.3/28156/Sat Oct 17 08:25:46 2026, report dated Sun Oct 18 01:59:55 CEST 2026.
The contrast is stark because this collection is made up of malware that the official databases do not cover
yet: that is precisely the role of complementary signatures. On older, widely distributed malware,
ClamAV alone detects perfectly. The two databases are designed to work together.
The malware found on hacked websites
Internet users generally believe that virus infections come mainly from attachments sent by email, or from files they deliberately download. Yet there is a far less visible danger: simply visiting a compromised website. The site may be perfectly legitimate and have been hacked without its owner's knowledge; the malicious code is planted there, then served to visitors. Infected websites therefore represent a very real risk.
To measure this risk, we continuously collect the files planted on hacked websites, then we scan them with ClamAV: first with the official databases only, then adding our signatures. Here are the results for the current collection.
Files collected
1 384
2 MB in total
Malware identified
1 356
28 clean files in the collection
Detected by the official ClamAV signatures
6
that is 0 % of the malware in the collection
Detected by the SecuriteInfo.com signatures
1 349
that is 99 % of the malware in the collection
File types found on infected websites
Breakdown of the 1 384 files collected
By detected format. The “Unrecognised files” category is placed last because it is not a format.
ELF binaries and shell scripts dominate: Linux web servers are the primary target, even ahead of Windows workstations. This is a classic blind spot of security policies focused on the desktop.
View the data table
| File type | Count | Share |
|---|---|---|
| ZIP | 519 | 38 % |
| ELF | 324 | 23 % |
| EXE | 94 | 7 % |
| JPG | 62 | 4 % |
| JAVA-CLASS | 9 | 1 % |
| HTML | 7 | 1 % |
| XML-1 | 6 | 0 % |
| VBS | 4 | 0 % |
| OFFICE | 3 | 0 % |
| WEBP | 1 | 0 % |
| PNG | 1 | 0 % |
| PHP | 1 | 0 % |
| LNK | 1 | 0 % |
| CAB | 1 | 0 % |
| Unknown | 351 | 25 % |
The TOP 50 detected malware
Ranking of the signatures triggered most often on the collection. The YARA.SecuriteInfo_* and SecuriteInfo.com.* signatures are ours; the Sanesecurity.* signatures come from another unofficial database that is also well established.
The 15 most frequent signatures
Number of occurrences across the 1 384 files collected.
View the full ranking of the 50 signatures
| # | Signature | Occurrences |
|---|---|---|
| 1 | SecuriteInfo.com.VBS.Obfus-141.UNOFFICIAL | 201 |
| 2 | SecuriteInfo.com.Win64.MalwareX-gen.89558412.UNOFFICIAL | 70 |
| 3 | SecuriteInfo.com.Linux.Mirai-58.UNOFFICIAL | 32 |
| 4 | YARA.SecuriteInfo_Linux_Shell_Downloader.UNOFFICIAL | 28 |
| 5 | SecuriteInfo.com.Trojan.Packed2.43192.UNOFFICIAL | 21 |
| 6 | SecuriteInfo.com.Win32.MalwareX-gen.92149132.UNOFFICIAL | 19 |
| 7 | SecuriteInfo.com.Win64.MalwareX-gen.79756775.UNOFFICIAL | 11 |
| 8 | SecuriteInfo.com.Trojan.Packed2.51179-8.UNOFFICIAL | 10 |
| 9 | SecuriteInfo.com.Linux.Mirai-38.UNOFFICIAL | 9 |
| 10 | SecuriteInfo.com.Linux.Flooder-5.UNOFFICIAL | 9 |
| 11 | SecuriteInfo.com.Generic-EXE.UNOFFICIAL | 9 |
| 12 | SecuriteInfo.com.Win64.MalwareX-gen.11375751.UNOFFICIAL | 8 |
| 13 | SecuriteInfo.com.Win32.MalwareX-gen.89963618.UNOFFICIAL | 8 |
| 14 | SecuriteInfo.com.Trojan.Packed2.51179-4.UNOFFICIAL | 8 |
| 15 | SecuriteInfo.com.Trojan.Packed2.51179-7.UNOFFICIAL | 7 |
| 16 | SecuriteInfo.com.Other.Malware-gen.34647816.UNOFFICIAL | 7 |
| 17 | SecuriteInfo.com.Linux.Mirai-61.UNOFFICIAL | 7 |
| 18 | YARA.SecuriteInfo_Miner_Config.UNOFFICIAL | 6 |
| 19 | SecuriteInfo.com.Trojan.Inject6.21613.6175.9078.UNOFFICIAL | 6 |
| 20 | SecuriteInfo.com.PUA.DiscordUrl-1.UNOFFICIAL | 6 |
| 21 | SecuriteInfo.com.Other.Malware-gen.75784791.UNOFFICIAL | 6 |
| 22 | SecuriteInfo.com.IMG.Malware-13.UNOFFICIAL | 6 |
| 23 | YARA.SecuriteInfo_Linux_Shell_Downloader_2.UNOFFICIAL | 5 |
| 24 | SecuriteInfo.com.Linux.BackDoor.Fgt.6204-2.UNOFFICIAL | 5 |
| 25 | YARA.SecuriteInfo_PUA_Suspicious_JS_1.UNOFFICIAL | 4 |
| 26 | SecuriteInfo.com.Variant.Lazy.638750.29272466.UNOFFICIAL | 4 |
| 27 | SecuriteInfo.com.PUA.Powershell.Downloader-3.UNOFFICIAL | 4 |
| 28 | Sanesecurity.Malware.29052.TSource.UNOFFICIAL | 4 |
| 29 | SecuriteInfo.com.Trojan.Script.718864.UNOFFICIAL | 3 |
| 30 | SecuriteInfo.com.Linux.Siggen.11883.UNOFFICIAL | 3 |
| 31 | SecuriteInfo.com.Linux.Mirai-54.UNOFFICIAL | 3 |
| 32 | SecuriteInfo.com.Linux.Mirai-45.UNOFFICIAL | 3 |
| 33 | SecuriteInfo.com.Linux.Mirai-19.UNOFFICIAL | 3 |
| 34 | SecuriteInfo.com.Linux.Mirai-18.UNOFFICIAL | 3 |
| 35 | SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL | 3 |
| 36 | SecuriteInfo.com.Java.Obfus-2.UNOFFICIAL | 3 |
| 37 | SecuriteInfo.com.HEUR.Trojan-PSW.Python.Agent.gen.8588.26986.UNOFFICIAL | 3 |
| 38 | PUA.Unix.Coinminer.XMRig-6683890-0 | 3 |
| 39 | SecuriteInfo.com.Win32.MalwareX-gen.42914233.UNOFFICIAL | 2 |
| 40 | SecuriteInfo.com.VBS.Trojan.Agent.38617-3.UNOFFICIAL | 2 |
| 41 | SecuriteInfo.com.Variant.Application.tedy.2261.UNOFFICIAL | 2 |
| 42 | SecuriteInfo.com.Trojan.Packed2.51496.31127.21892.UNOFFICIAL | 2 |
| 43 | SecuriteInfo.com.Trojan.Packed2.51179-3.UNOFFICIAL | 2 |
| 44 | SecuriteInfo.com.Linux.MiraiPacked.91454764.UNOFFICIAL | 2 |
| 45 | SecuriteInfo.com.Linux.Mirai-20.UNOFFICIAL | 2 |
| 46 | SecuriteInfo.com.Java.Obfus-11.UNOFFICIAL | 2 |
| 47 | Sanesecurity.Malware.30435.LC.UNOFFICIAL | 2 |
| 48 | PUA.Win.Adware.Dealply-6619242-0 | 2 |
| 49 | YARA.SecuriteInfo_VBA_Exec_2.UNOFFICIAL | 1 |
| 50 | YARA.SecuriteInfo_Suspicious_File.UNOFFICIAL | 1 |
A few important remarks
- The statistics published here do not take into account the spam detection signatures, which are delivered with the SecuriteInfo.com signatures. These statistics cover malware only.
- The signatures published by SecuriteInfo.com are complementary to the official ClamAV signatures. This means that when a malware sample is detected by the official ClamAV signatures, it is removed from the SecuriteInfo.com signatures. There is therefore no duplicate signature between the official ClamAV signatures and the SecuriteInfo.com signatures.
- These statistics change every day, and are therefore published daily.
- The collection of files from hacked websites is built continuously; the detection rates reflect the state of the databases as of the report date shown at the top of the page.
Improve your ClamAV detection rate today
The Basic plan is free. Installation comes down to adding a few URLs to your freshclam.conf: no changes to ClamAV are required.
ClamAV is copyright © Cisco Systems, Inc.
A few suggestions on the topic of the ClamAV antivirus
Did you enjoy this article? Here are a few suggestions you should like:
- Improve the detection rate of 0-day malware for ClamAV
- ClamAV for Windows is possible with ClamShield
- PUA (Potentially Unwanted Application): understanding and managing unwanted software in your IT environment
- FAQ about ClamAV and the unofficial signatures from SecuriteInfo.com
- Old versions of ClamAV put your information system at risk
Tags
Inscription à notre lettre d'information
Inscrivez-vous à notre lettre d'information pour vous tenir au courant de nos actualités et de nos dernières trouvailles.
© 2000-2026 - Tous droits réservés SecuriteInfo.com