How to scan a server for malware

Quick answer: Use ClamAV for general file scanning, rkhunter/chkrootkit for rootkit signs, and Linux Malware Detect (maldet) for web-hosting malware. Scans find known threats and obvious anomalies — but on a confirmed compromise, only a clean OS reinstall gives certainty.

Overview

Malware on Linux servers usually arrives through vulnerable web apps, stolen credentials or unpatched services. Scanners are good at detection and cleanup of commodity threats and web shells; they are weaker against rootkits that subvert the system itself. Combine scanning with the prevention layers in this category, and treat scanner output as evidence, not gospel.

Before you start

• Root/sudo access; scans are I/O and CPU heavy — schedule them off-peak.
• Free disk space for signature databases and quarantine.

Step-by-step guide

1. ClamAV:

   apt install clamav clamav-daemon -y      # Ubuntu/Debian
   dnf install clamav clamav-update -y      # Alma/Rocky (EPEL)
   freshclam
   clamscan -r --infected /home /var/www

2. rkhunter:

   apt install rkhunter -y
   rkhunter --update
   rkhunter --check --sk

   Review warnings in /var/log/rkhunter.log — many are explainable config choices.
3. chkrootkit: apt install chkrootkit -y && chkrootkit as a second opinion.
4. maldet (web hosting): install from rfxn.com, then maldet -a /var/www to scan and quarantine web shells.
5. Cross-check findings: process list (ps auxf), open sockets (ss -tulpn), cron entries and recently modified files (find /var/www -mtime -3 -type f).

Common issues

• False positives: rkhunter flags legitimate changes after updates — run rkhunter --propupd after known-good changes only.
• Scanner finds nothing but the server misbehaves: rootkits can hide from local tools; compare from outside (network flows, KVM Console) — see what to do if your server is hacked.
• ClamAV RAM usage: the daemon needs ~1 GB+; on small VPS run one-off clamscan instead of clamd.

When to contact support

If malware is confirmed and the service is attacking others (abuse reports, outbound floods), tell Cloud2Y support what happened and your cleanup plan — proactive contact avoids abuse-driven suspension (abuse policy).

Frequently asked questions

Which malware scanner should I use on Linux?

ClamAV for general file scanning, rkhunter and chkrootkit for rootkit indicators, and Linux Malware Detect for web-hosting threats — they complement each other rather than compete.

Can a scan guarantee my server is clean?

No. Scanners detect known signatures and obvious anomalies, but a rootkit with root privileges can hide from local tools. After a confirmed compromise only a clean OS reinstall is trustworthy.

How often should I scan the server?

Weekly scheduled scans are a reasonable baseline for a web server, plus an immediate scan whenever you see unexplained load, traffic or file changes in your monitoring.

Related articles

• What to do if your server is hacked
• What to do if your server is compromised
• How to keep Linux packages updated
• How to secure WordPress on a VPS

Need a hand? Contact Cloud2Y support →