2 Theory

ClamFS (“Clam File System”) is Linux (possibly available to other Unix-like operating systems) file system that shadows a real directory. Essentially, accesses to files in a ClamFS directory trigger virus scan on-the-fly. If malware is detected in a file by the ClamAV daemon, access to the file is denied. It also features caching so that recently scanned files do not get scanned repeatedly.

Visit the ClamFS homepage here (http://clamfs.sourceforge.net) for more information.

The most important advantage (from the end-user’s perspective) is that it is transparent, and every file access from a ClamFS directory is scanned.

From the administrator’s perspective, ClamFS uses FUSE (Filesystem in User Space). This means that ClamFS can be used on a variety of kernels without having to recompile a kernel for kernel-mode drivers.