How to Scan Linux Server for Malware and Backdoors (ClamAV & Maldet Tutorial)

Common Linux Web Server Threats in 2026

Compromised WordPress installations, outdated plugins, and vulnerable upload forms frequently result in attacker webshells (like c99, r57, and WSO), obfuscated PHP backdoors, crypto-miners, and hidden cron scripts. Standard antivirus software built for Windows cannot effectively detect PHP-based server malware. Pairing Linux Malware Detect (LMD) with ClamAV provides comprehensive dual-layer threat detection designed specifically for hosting environments.

Step 1: Installing ClamAV Binary Engine

ClamAV acts as a high-speed scanning backend for Maldet, speeding up scanning throughput by over 10x:

# Install ClamAV daemon and freshclam database updater
sudo apt update && sudo apt install clamav clamav-daemon -y

# Update ClamAV virus signatures
sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam

Step 2: Installing Linux Malware Detect (Maldet)

Download and install the latest official Maldet release:

cd /tmp
curl -O https://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzf maldetect-current.tar.gz
cd maldetect-*
sudo ./install.sh

Step 3: Configuring Automatic Quarantine & Email Alerts

Edit /usr/local/maldetect/conf.maldet to enable automated quarantine of malicious payloads:

sudo nano /usr/local/maldetect/conf.maldet

Update these directives:

# Enable email alerts
email_alert="1"
email_addr="[email protected]"

# Enable ClamAV as high-speed scanning backend
scan_clamav="1"

# Automatically quarantine infected files
quarantine_hits="1"
quarantine_clean="1"

Step 4: Running a Targeted Malware Scan

Update signatures and scan your web directories:

# Update signatures
maldet -u

# Scan all public_html and /var/www directories
maldet -a /var/www/
maldet -a /home/*/public_html/

# View the latest scan report
maldet --report SCAN_ID

Setting Up Automated Nightly Malware Scans via Cron

To ensure your web applications remain clean without manual intervention, configure a system cron job to scan web roots nightly and dispatch email alerts upon detecting suspicious PHP injection patterns:

# Create automated malware scanning cron script
sudo nano /etc/cron.daily/maldet-nightly-scan

#!/bin/bash
/usr/local/bin/maldet -u > /dev/null 2>&1
/usr/local/bin/maldet -a /var/www /home/*/public_html >> /var/log/maldet_scan.log 2>&1

sudo chmod +x /etc/cron.daily/maldet-nightly-scan

Inspecting Suspicious Cron Jobs and Rogue SSH Keys

Attackers who compromise a PHP web application frequently establish persistence through hidden user cron jobs and unauthorized SSH keys. Audit system cron directories regularly:

# Check crontabs for all system users
for user in $(cut -f1 -d: /etc/passwd); do sudo crontab -u $user -l 2>/dev/null; done

# Check system cron directories
ls -la /etc/cron* /var/spool/cron/crontabs/

Detailed Analysis of Common Web Server Backdoors and Webshells

Web server malware operates differently than desktop viruses. Attackers rarely execute destructive commands; instead, they plant subtle, stealthy backdoors to monetize your server resources. Here are the 3 most prevalent threats detected by LMD & ClamAV:

• PHP Webshells (c99, r57, b374k, WSO): Complete web-based file managers injected into wp-content/uploads/ that allow remote attackers to execute terminal commands, dump MySQL databases, and edit core application files through a hidden browser interface.
• Malicious SEO Spam & Redirection Injections: Code snippets injected into index.php or wp-config.php that detect search engine bots (Googlebot) and serve invisible spam links or redirect mobile visitors to fraudulent phishing landing pages.
• Crypto-Miners & Botnet Workers (XMRig / Mirai): Binary executables placed in /tmp or /dev/shm that consume 100% of server CPU cores mining cryptocurrency or launching distributed denial of service (DDoS) attacks against third parties.

Hardening PHP Configuration (disable_functions) to Prevent Execution

In addition to scanning for malware, prevent webshells from executing dangerous system-level commands by adding a robust disable_functions directive to your php.ini configuration:

# /etc/php/8.3/fpm/php.ini
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source

Automated ClamAV Daemon Inotify Real-Time Filesystem Monitoring

Rather than relying solely on nightly cron scans, you can configure clamd with Linux kernel inotify filesystem watches (using clamonacc). This enables continuous real-time protection that automatically scans every new file uploaded via PHP, FTP, or SSH the millisecond it is written to disk:

# Enable real-time on-access scanning in clamd.conf
sudo nano /etc/clamav/clamd.conf

# Add directives:
OnAccessMaxFileSize 20M
OnAccessIncludePath /var/www
OnAccessPrevention yes

# Start real-time on-access daemon
sudo systemctl enable --now clamav-clamonacc

Recovering and Cleaning a Hacked WordPress Database

Malware frequently injects malicious JavaScript redirects and rogue administrator users directly into the MySQL database (specifically the wp_options and wp_users tables). After scanning files, audit your WordPress database:

# Check for unauthorized administrator users in database
wp user list --role=administrator --allow-root

# Scan core WordPress files against official checksums
wp core verify-checksums --allow-root
wp plugin verify-checksums --all --allow-root

Integrating ClamAV with Nextcloud & Web Upload Gateways

If your Linux VPS hosts cloud storage portals like Nextcloud or custom web applications accepting user file uploads, configure ClamAV Daemon sockets directly within your web application settings. This ensures every uploaded PDF, image, or ZIP archive is scanned in memory before being committed to persistent NVMe disk storage, preventing malicious payload distribution.

Frequently Asked Questions