A powerful, privacy-focused browser-based antivirus scanner powered by official ClamAV virus databases. Scan files for malware directly in your web browser with zero server uploads – all processing happens locally on your device.
🔗 Live Demo: https://xsukax.github.io/xsukax-ClamAV-Scanner
xsukax ClamAV Scanner is a client-side web application that brings the trusted ClamAV antivirus engine directly to your browser. Unlike traditional antivirus solutions that require software installation or cloud uploads, this scanner operates entirely within your web browser using JavaScript and Web APIs.
The application leverages official ClamAV CVD (ClamAV Virus Database) files maintained by Cisco Talos, providing access to millions of malware signatures including viruses, trojans, worms, ransomware, and other threats. By utilizing hash-based detection methods (MD5, SHA1, SHA256), it can identify known malicious files quickly and efficiently without requiring complex pattern matching or behavioral analysis.
- Database Management: Load and parse official ClamAV CVD/CLD files containing millions of virus signatures
- Multi-File Scanning: Scan single or multiple files simultaneously with real-time progress tracking
- Hash-Based Detection: Utilizes MD5, SHA1, and SHA256 cryptographic hashes for precise malware identification
- CVD Extraction: Automatically extracts and processes compressed TAR.GZ archives within CVD containers
- Comprehensive Results: Detailed scan reports showing threat names, database sources, and detection methods
- Modern Interface: Intuitive, responsive design with real-time statistics and visual feedback
xsukax ClamAV Scanner is architected with privacy and security as foundational principles, ensuring users maintain complete control over their data throughout the scanning process.
All file analysis, hash computation, and malware detection operations execute entirely within the user's browser. No files, file contents, hashes, or metadata are ever transmitted to external servers, third-party services, or remote endpoints. This architecture eliminates the risks associated with cloud-based scanning services, including data interception, unauthorized access, and privacy breaches.
The application neither collects, stores, nor transmits any user data, scan results, or analytical information. There are no tracking mechanisms, analytics services, or telemetry systems integrated into the codebase. Users can verify this commitment by inspecting the transparent, open-source code.
The scanner exclusively utilizes authentic ClamAV virus databases distributed by Cisco Talos through official channels (database.clamav.net). These databases undergo rigorous verification processes and are digitally signed to prevent tampering. Users download databases directly from ClamAV's official infrastructure, ensuring signature authenticity and integrity.
File scanning employs industry-standard cryptographic hash functions:
- MD5: Legacy support for compatibility with older signature databases
- SHA-1: Widely adopted hash algorithm for malware identification
- SHA-256: Modern, cryptographically secure hash function resistant to collision attacks
These hashing operations occur locally using the browser's native Web Crypto API and trusted JavaScript libraries (CryptoJS), ensuring computational integrity without external dependencies.
The entire application source code is publicly accessible on GitHub, enabling security researchers, developers, and privacy advocates to audit, verify, and contribute to the project. This transparency fosters trust and allows the community to identify and address potential vulnerabilities collaboratively.
As a static HTML application, xsukax ClamAV Scanner requires no backend infrastructure, databases, or server-side processing. This architecture eliminates entire categories of security vulnerabilities including SQL injection, server-side code execution, authentication bypasses, and data breaches associated with server compromise.
Once the application page is loaded and virus databases are downloaded, users can operate the scanner without an active internet connection. Files can be scanned in air-gapped environments or on systems with restricted network access, providing security benefits for sensitive operational contexts.
- 🛡️ Official ClamAV Integration: Supports main.cvd and daily.cvd databases containing approximately 7 million combined signatures
- 📦 Automatic CVD Extraction: Seamlessly decompresses and parses GZIP-compressed TAR archives within CVD containers
- 🔍 Multi-Hash Detection: Employs MD5, SHA1, and SHA256 hash matching for comprehensive threat identification
- 📊 Real-Time Statistics: Live dashboard displaying loaded databases, signature counts, scan progress, and detection rates
- 🎯 Detailed Threat Reporting: Identifies specific malware names, source databases, and matched hash types for detected threats
- ⚡ Batch Scanning: Process multiple files simultaneously with asynchronous operations for optimal performance
- 💾 No Installation Required: Runs directly in any modern web browser without plugins, extensions, or software installation
- 🎨 Modern Interface: Gradient-enhanced, responsive design optimized for desktop and mobile devices
- 🔄 Drag-and-Drop Support: Intuitive file selection via drag-and-drop or traditional file browser
- 📈 Progress Tracking: Visual progress bars and status indicators for long-running operations
- 🔔 Smart Notifications: Toast-style notifications for operation success, warnings, and errors
- 📋 Database Viewer: Inspect loaded databases, signature counts, extracted files, and source information
- 🗑️ Easy Management: Clear scan results or remove databases with single-click actions
- Zero Latency: No network round-trips for file uploads; instant hash computation and comparison
- Unlimited File Size: No server-imposed file size restrictions (limited only by browser memory)
- Privacy by Design: Architecture fundamentally prevents data leakage or unauthorized access
- Cross-Platform: Compatible with Windows, macOS, Linux, and mobile operating systems
- No Dependencies: Self-contained HTML file with CDN-hosted libraries (Tailwind CSS, Pako, CryptoJS)
- Extensible: Modular JavaScript architecture facilitates future enhancements and custom integrations
| Feature | xsukax ClamAV Scanner | Cloud-Based Scanners | Desktop Antivirus |
|---|---|---|---|
| Privacy | ✅ Complete | ❌ Files uploaded | |
| Installation | ✅ None required | ✅ Browser only | ❌ Required |
| Internet Required | ❌ Always | ||
| File Size Limits | ✅ None* | ❌ Typically 100-500MB | ✅ None |
| Cost | ✅ Free & Open Source | ||
| Transparency | ✅ Full source access | ❌ Proprietary | ❌ Proprietary |
*Limited by browser memory availability
xsukax ClamAV Scanner is a static web application requiring no traditional installation process. Multiple deployment options are available depending on your use case.
Access the scanner immediately through the live demo:
https://xsukax.github.io/xsukax-ClamAV-Scanner
This option requires no setup and is maintained with the latest updates from the repository.
-
Download the Application
# Clone the repository git clone https://github.com/xsukax/xsukax-ClamAV-Scanner.git # Navigate to the directory cd xsukax-ClamAV-Scanner
-
Open in Browser
Simply open
index.htmlin any modern web browser:- Windows: Double-click
index.htmlor right-click → Open with → Your browser - macOS: Double-click
index.htmlor useopen index.htmlin Terminal - Linux: Double-click
index.htmlor usexdg-open index.htmlin Terminal
Alternatively, use a local web server for enhanced compatibility:
# Using Python 3 python -m http.server 8000 # Using Python 2 python -m SimpleHTTPServer 8000 # Using Node.js (with npx) npx http-server -p 8000 # Using PHP php -S localhost:8000
Then navigate to
http://localhost:8000in your browser. - Windows: Double-click
- Upload Files: Transfer
index.htmlto your web server's public directory - Configure (if needed): No server-side configuration required; ensure static file serving is enabled
- Access: Navigate to your server's URL in a web browser
- Browser: Any modern browser with ES6 JavaScript support
- Chrome/Edge 60+
- Firefox 60+
- Safari 12+
- Opera 47+
- Memory: Minimum 2GB RAM recommended (4GB+ for large databases)
- Storage: ~200MB free space for downloading ClamAV databases
- Internet: Required initially to download virus databases and load CDN resources
No PHP or Server-Side Configuration Required: This application is a pure client-side HTML/JavaScript solution that operates entirely within the browser. Unlike traditional web applications, it does not require:
- PHP, Node.js, Python, or any server-side runtime
- Database servers (MySQL, PostgreSQL, MongoDB, etc.)
- Web server configuration files (php.ini, .htaccess, nginx.conf, etc.)
- SSL certificates or HTTPS enforcement (though recommended for production)
- Server-side permissions or directory write access
The application can be served by any static file server or opened directly as a local file. If deploying to a web server, simply ensure that:
- Static HTML files can be served
- No special MIME type configurations are needed
- CORS headers are not required (all resources are self-contained or from trusted CDNs)
The scanning process follows a straightforward three-step workflow: database loading, file selection, and threat detection.
graph TD
A[Start: Open Application] --> B[Download ClamAV Databases]
B --> C[Load CVD Files into Scanner]
C --> D[Select Files to Scan]
D --> E[Execute Scan Operation]
E --> F{Threats Detected?}
F -->|Yes| G[Review Infected Files]
F -->|No| H[All Files Clean]
G --> I[Take Action on Threats]
H --> I
I --> J[Clear Results if Needed]
J --> K{Scan More Files?}
K -->|Yes| D
K -->|No| L[End Session]
- Click the "🌐 Get Database Downloads" button
- Review the available official ClamAV databases:
- main.cvd: Core database (~100 MB, ~4 million signatures)
- daily.cvd: Daily updates (~50 MB, ~3 million signatures)
- Click "⬇️ Download to PC" for each database
- Wait for downloads to complete (may take several minutes depending on connection speed)
Recommended: Download both main.cvd and daily.cvd for comprehensive protection.
- Click "📁 Load CVD Files from PC"
- In the file browser, navigate to your downloads folder
- Select all downloaded
.cvdfiles (hold Ctrl/Cmd for multiple selection) - Click Open
- Wait for extraction and parsing (progress displayed in modal dialog)
- Confirm successful loading via the status indicator showing "✅ X database(s) loaded"
- Select Files:
- Drag and drop files directly onto the upload zone, or
- Click the upload zone to browse and select files
- Multiple files can be selected simultaneously
- Click "🔍 Start Scan" button
- Monitor real-time progress bar and file-by-file scanning status
- Review results in the "Scan Results" section:
- ✅ CLEAN: File passed all signature checks
⚠️ [Threat Name]: File matched known malware signature
Scan results display comprehensive information for each file:
graph LR
A[Scan Result] --> B{Detection Status}
B -->|Clean| C[✅ No threats found]
B -->|Infected| D[⚠️ Threat Detected]
D --> E[Malware Name]
D --> F[Source Database]
D --> G[Hash Type Match]
D --> H[Database Subfile]
Clean File Example:
example-document.pdf | ✅ CLEAN
Infected File Example:
suspicious-file.exe | ⚠️ Win.Trojan.Generic-12345
└─ main.cvd → main.hdb
Click "👁️ View Loaded Databases" to inspect:
- Database filenames and types
- Signature counts per database
- Extracted internal files (.hdb, .ndb, .mdb, etc.)
- Database source (local upload)
Click "🗑️ Clear All Databases" to remove all loaded virus signatures from memory. This action:
- Frees browser memory
- Requires reloading databases before next scan
- Does not delete downloaded CVD files from your computer
Click "🗑️ Clear Results" to:
- Remove all scan result entries
- Reset statistics counters
- Clear file selection
- Prepare for a new scanning session
graph TB
subgraph "Browser Environment"
A[User Interface Layer] --> B[CVD Management Module]
A --> C[File Scanner Module]
B --> D[CVD Extractor]
D --> E[GZIP Decompressor - Pako]
D --> F[TAR Parser]
F --> G[Signature Database Store]
C --> H[File Reader API]
H --> I[Hash Calculator]
I --> J[MD5 - CryptoJS]
I --> K[SHA1 - Web Crypto API]
I --> L[SHA256 - Web Crypto API]
J --> M[Signature Matcher]
K --> M
L --> M
G --> M
M --> N[Scan Results Aggregator]
N --> A
end
O[ClamAV Database Server] -.Download.-> B
P[User Files - Local System] -.Select.-> C
The malware detection workflow operates as follows:
- File Ingestion: Selected files are read into browser memory using the File API
- Hash Computation: Three cryptographic hashes are calculated for each file:
- MD5 using CryptoJS library
- SHA-1 using Web Crypto API
- SHA-256 using Web Crypto API
- Signature Matching: Computed hashes are compared against loaded database signatures:
- Iterate through all loaded databases sequentially
- Check each hash type (MD5, SHA1, SHA256) against signature maps
- Return immediately upon first match (short-circuit evaluation)
- Result Compilation: Matched signatures are linked to malware names and database metadata
- UI Presentation: Results are aggregated and displayed with statistics and actionable information
- Large Files: Hashing performance depends on file size and system capabilities
- Many Files: Batch scanning uses asynchronous operations to prevent UI freezing
- Memory Usage: Each loaded database and scanned file consumes browser memory
- Database Loading: Initial CVD extraction may take 30-60 seconds per database
- Hash-Based Only: Does not perform heuristic, behavioral, or pattern-based detection
- Known Threats Only: Can only identify malware present in loaded signature databases
- No Disinfection: Does not clean or quarantine infected files (detection only)
- Browser Constraints: Limited by JavaScript execution speed and available memory
- Database Updates: Requires manual download of updated CVD files for latest signatures
This project is licensed under the GNU General Public License v3.0.
Contributions, issues, and feature requests are welcome! Feel free to check the issues page.
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing-feature) - Commit your changes (
git commit -m 'Add amazing feature') - Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
This scanner provides hash-based malware detection using official ClamAV databases. While effective against known threats, it should not be considered a replacement for comprehensive endpoint security solutions. Always maintain:
- Updated operating system security patches
- Active endpoint protection software
- Regular system backups
- Safe browsing and download practices
- Multi-layered security approach
The developers assume no liability for damages resulting from malware infections, false negatives, or misuse of this tool.
- ClamAV Project: For providing free, open-source antivirus databases maintained by Cisco Talos
- Pako: High-performance GZIP compression/decompression library
- CryptoJS: Comprehensive JavaScript cryptography library
- Tailwind CSS: Utility-first CSS framework for rapid UI development
- Issues: GitHub Issues
- Repository: GitHub
- Live Demo: https://xsukax.github.io/xsukax-ClamAV-Scanner
Built with ❤️ for privacy and security by xsukax