This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand". It is also target to Desktop usage only.
The current version at this writing is ClamAV 0.99.
Step 1 :
sudo apt-get install clamav clamav-freshclam clamav-daemon libclamunrar7
Step 2 :
sudo nano /etc/clamav/clamd.conf
To make the entries looking like the following. Make sure to replace "samiux" with your username.
cd ~
mkdir quarantine
Step 3 :
sudo nano /etc/clamav/freshclam.conf
To make the entries looking like the following.
sudo systemctl enable clamav-daemon
sudo systemctl restart clamav-daemon
sudo freshclam
Remark :
Download or copy will not trigger the ClamAV scan but browsing or executing (or etc) will. If any malware or virus (no matter it is for Windows, Linux or Mac OSX) is detected, it will be moved to "quarantine" directory. You can also check the log at "/var/log/clamav/clamav.log". Be aware that ClamAV may produce a lot of false positive warning in Linux.
Testing :
You can install NO harm virus testing files for testing.
sudo apt-get install clamav-testfiles
The NO harm virus testing files are located at "/usr/share/clamav-testfiles".
Reference
AppArmor Wiki
That's all! See you.