{"id":1373,"date":"2026-09-03T11:37:48","date_gmt":"2026-09-03T06:07:48","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-scan-linux-server-malware-maldet-clamav\/"},"modified":"2026-09-03T12:32:27","modified_gmt":"2026-09-03T07:02:27","slug":"how-to-scan-linux-server-malware-maldet-clamav","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-scan-linux-server-malware-maldet-clamav\/","title":{"rendered":"How to Scan Linux Server for Malware and Backdoors (ClamAV & Maldet Tutorial)"},"content":{"rendered":"
\n

\n Quick Answer:<\/strong> To scan a Linux server for malware and backdoors, install Linux Malware Detect (LMD\/Maldet)<\/strong> paired with the ClamAV<\/strong> binary scanning engine. Update threat signatures with maldet -u<\/code>, execute a full scan on your web directories with maldet -a \/var\/www\/<\/code>, and inspect quarantined malicious files with maldet --report<\/code>.\n <\/p>\n<\/div>\n

Common Linux Web Server Threats in 2026<\/h2>\n

Compromised WordPress installations, outdated plugins, and vulnerable upload forms frequently result in attacker webshells (like c99, r57, and WSO), obfuscated PHP backdoors, crypto-miners, and hidden cron scripts. Standard antivirus software built for Windows cannot effectively detect PHP-based server malware. Pairing Linux Malware Detect (LMD)<\/strong> with ClamAV<\/strong> provides comprehensive dual-layer threat detection designed specifically for hosting environments.<\/p>\n

Step 1: Installing ClamAV Binary Engine<\/h2>\n

ClamAV acts as a high-speed scanning backend for Maldet, speeding up scanning throughput by over 10x:<\/p>\n

# Install ClamAV daemon and freshclam database updater\nsudo apt update && sudo apt install clamav clamav-daemon -y\n\n# Update ClamAV virus signatures\nsudo systemctl stop clamav-freshclam\nsudo freshclam\nsudo systemctl start clamav-freshclam<\/pre>\n
Step 2: Installing Linux Malware Detect (Maldet)<\/h2>\n
Download and install the latest official Maldet release:<\/p>\n
cd \/tmp\ncurl -O https:\/\/www.rfxn.com\/downloads\/maldetect-current.tar.gz\ntar -xzf maldetect-current.tar.gz\ncd maldetect-*\nsudo .\/install.sh<\/pre>\n
Step 3: Configuring Automatic Quarantine & Email Alerts<\/h2>\n
Edit \/usr\/local\/maldetect\/conf.maldet<\/code> to enable automated quarantine of malicious payloads:<\/p>\n
sudo nano \/usr\/local\/maldetect\/conf.maldet<\/pre>\n
Update these directives:<\/p>\n
# Enable email alerts\nemail_alert=\"1\"\nemail_addr=\"admin@yourdomain.com\"\n\n# Enable ClamAV as high-speed scanning backend\nscan_clamav=\"1\"\n\n# Automatically quarantine infected files\nquarantine_hits=\"1\"\nquarantine_clean=\"1\"<\/pre>\n
Step 4: Running a Targeted Malware Scan<\/h2>\n
Update signatures and scan your web directories:<\/p>\n
# Update signatures\nmaldet -u\n\n# Scan all public_html and \/var\/www directories\nmaldet -a \/var\/www\/\nmaldet -a \/home\/*\/public_html\/\n\n# View the latest scan report\nmaldet --report SCAN_ID<\/pre>\n
Setting Up Automated Nightly Malware Scans via Cron<\/h2>\n
To ensure your web applications remain clean without manual intervention, configure a system cron job to scan web roots nightly and dispatch email alerts upon detecting suspicious PHP injection patterns:<\/p>\n
# Create automated malware scanning cron script\nsudo nano \/etc\/cron.daily\/maldet-nightly-scan\n\n#!\/bin\/bash\n\/usr\/local\/bin\/maldet -u > \/dev\/null 2>&1\n\/usr\/local\/bin\/maldet -a \/var\/www \/home\/*\/public_html >> \/var\/log\/maldet_scan.log 2>&1\n\nsudo chmod +x \/etc\/cron.daily\/maldet-nightly-scan<\/pre>\n
Inspecting Suspicious Cron Jobs and Rogue SSH Keys<\/h2>\n
Attackers who compromise a PHP web application frequently establish persistence through hidden user cron jobs and unauthorized SSH keys. Audit system cron directories regularly:<\/p>\n
# Check crontabs for all system users\nfor user in $(cut -f1 -d: \/etc\/passwd); do sudo crontab -u $user -l 2>\/dev\/null; done\n\n# Check system cron directories\nls -la \/etc\/cron* \/var\/spool\/cron\/crontabs\/<\/pre>\n
Detailed Analysis of Common Web Server Backdoors and Webshells<\/h2>\n
Web server malware operates differently than desktop viruses. Attackers rarely execute destructive commands; instead, they plant subtle, stealthy backdoors to monetize your server resources. Here are the 3 most prevalent threats detected by LMD & ClamAV:<\/p>\n