Linux Malware Scan with ClamAV and Maldet on a VPS

A compromised website often hides a PHP web shell or injected JavaScript long before anyone notices. A regular Linux malware scan with ClamAV and Linux Malware Detect (maldet) catches many of these early. Both are free and run well on a VPS.

Before you start

Root access to an Ubuntu/Debian or AlmaLinux/Rocky VPS.
At least 1–2 GB free RAM while ClamAV loads its signatures.
A backup of the sites you will scan, in case you need to restore cleaned files.
On cPanel servers with Imunify360, use its scanner instead; it is built for that platform.

Install ClamAV

Ubuntu/Debian:

apt update && apt install clamav clamav-daemon

AlmaLinux/Rocky:

dnf install epel-release && dnf install clamav clamav-update clamd

Update the virus signatures. On Debian/Ubuntu, the clamav-freshclam service does this automatically; stop it first to run a manual update:

systemctl stop clamav-freshclam && freshclam && systemctl enable --now clamav-freshclam

On AlmaLinux run freshclam and enable the timer or a cron job for regular updates.

Run a ClamAV scan

clamscan -r -i --exclude-dir='^/var/www/.*/cache' /var/www

-r recursive, -i only list infected files.
Add --move=/root/quarantine to move detections away (create the folder first). Avoid --remove until you trust the results.

For faster repeated scans, use the daemon: clamdscan --multiscan --fdpass -i /var/www.

Install Linux Malware Detect

Maldet focuses on threats seen on shared hosting: PHP shells, mailers and backdoors. It uses ClamAV's engine when available, which speeds it up.

cd /usr/local/src && wget https://www.rfxn.com/downloads/maldetect-current.tar.gz

tar -xzf maldetect-current.tar.gz && cd maldetect-*/ && ./install.sh

Update its signatures:

maldet -u

Configure and run maldet

Edit /usr/local/maldetect/conf.maldet. Useful settings:

email_alert="1"
email_addr="you@example.com"
quarantine_hits="1"
quarantine_clean="0"
scan_clamscan="1"

quarantine_hits=1 moves detections to quarantine automatically. Run a scan:

maldet -a /var/www

Scan only files changed in the last 2 days (fast, good for daily use):

maldet -r /var/www 2

View a report with maldet --report SCANID and restore a false positive with maldet --restore /usr/local/maldetect/quarantine/file.12345.

Schedule daily scans

Maldet installs a daily cron job in /etc/cron.daily/maldet that updates signatures and scans recent changes. For ClamAV, add a weekly full scan:

0 4 * * 0 /usr/bin/clamscan -r -i /var/www >> /var/log/clamscan-weekly.log 2>&1

What to do when malware is found

Do not just delete files: find how they got in. Check web server access logs around the file's modification time (stat file).
Update the CMS, themes and plugins; remove unused ones.
Replace core files with clean copies, change all passwords and database credentials, and review user accounts.
Rescan, and restore from a clean backup if the infection is widespread.

Troubleshooting

freshclam: locked by another process: the freshclam service is already updating; stop it before running freshclam by hand.
clamscan is killed or very slow: not enough RAM for signatures. Use the daemon, add swap, or scan smaller directories.
Many false positives: obfuscated but legitimate code (licence checks, minified JS) can trigger signatures. Review before deleting.

Malware scanning FAQ

Is ClamAV enough on its own?

It detects many known threats but misses some web-specific ones. Combining it with maldet improves coverage; neither replaces updates and good passwords.

How often should I scan?

Daily scans of recently changed files and a weekly full scan suit most VPS sites.

Does MdmHost hosting scan for malware?

MdmHost's cPanel hosting runs on CloudLinux with server-side security. For your own VPS, the scanning setup is up to you.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket