Fix ClamAV account setup and add install verification

install.sh

@@ -39,7 +39,7 @@ command -v apt-get >/dev/null || die "This installer currently supports Debian/U
 log "Installing base dependencies"
 apt-get update -y
 DEBIAN_FRONTEND=noninteractive apt-get install -y \
-  ca-certificates curl python3 iproute2 procps util-linux iptables coreutils
+  ca-certificates curl python3 iproute2 procps util-linux iptables coreutils passwd
 
 install -d -m 700 /etc/malware-watch /var/lib/malware-watch /var/lib/malware-watch/feeds
 install -d -m 700 /root/security-evidence/malware-watch /root/security-evidence/quarantine
@@ -481,6 +481,15 @@ if [[ "$INSTALL_CLAMAV" == "1" ]]; then
 
   [[ -x /usr/local/bin/clamscan ]] || die "Official ClamAV clamscan not found after installation"
   [[ -f /usr/local/etc/freshclam.conf.sample ]] || die "freshclam.conf.sample not found"
+
+  # Official ClamAV packages can be present without a pre-created service account.
+  # Ensure the account exists before assigning ownership to the signature DB directory.
+  if ! getent group clamav >/dev/null 2>&1; then
+    groupadd --system clamav
+  fi
+  if ! id -u clamav >/dev/null 2>&1; then
+    useradd --system --gid clamav --home-dir /var/lib/clamav --shell /usr/sbin/nologin clamav
+  fi
   install -d -o clamav -g clamav -m 755 /var/lib/clamav
   cp /usr/local/etc/freshclam.conf.sample /usr/local/etc/freshclam.conf
   sed -i 's/^Example/#Example/' /usr/local/etc/freshclam.conf