> Antivirus software has to have full access to every part of your system so it can scan and remove things. Removal/quarantining of bad files does require elev

> Antivirus software has to have full access to every part of your system so it can scan and remove things. Removal/quarantining of bad files does require elevated privileges, but just scanning and warning, no. Let's take ClamAV as an example. It has three processes: * clamonacc: runs as root, watches for file open/change/close events, does not do any parsing (so it is mostly safe, the only real problems that I encountered are file descriptor exhaustion attacks and slow/hanging filesystems like FUSE or NFS), just forwards the file descriptor to clamd via a socket * clamd: runs unprivileged, gets pre-opened files to scan from clamonacc, runs virus-event scripts also unprivileged * freshclam: runs unprivileged, does nothing except updating the virus databases and telling clamd about that, so no attack surface here