Updated: 28 September 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9
A firewall and regular updates are the first defence. Scanners help you check that nothing got through. Run them regularly (for example nightly) and whenever you see suspicious activity such as high load, unknown processes or outgoing spam. The tools below work on Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9; run them as root.
ClamAV: malware and virus scanner
dnf install epel-release && dnf install clamav clamav-update # AlmaLinux / Rocky apt install clamav # Ubuntu / Debian freshclam # update signatures (on Ubuntu the clamav-freshclam service does this) clamscan -r -i /home # scan, print only infected files
Add --move=/root/quarantine to move infected files away instead of just listing them.
Linux Malware Detect (LMD): for web hosting
LMD focuses on malware found in websites (PHP shells, injected scripts) and can use ClamAV's engine:
cd /usr/local/src wget https://www.rfxn.com/downloads/maldetect-current.tar.gz tar xzf maldetect-current.tar.gz && cd maldetect-*/ ./install.sh maldet -u # update signatures maldet -a /var/www # scan a folder maldet --report list
rkhunter and chkrootkit: rootkit scanners
dnf install epel-release && dnf install rkhunter # AlmaLinux / Rocky apt install rkhunter chkrootkit # Ubuntu / Debian (chkrootkit is not in EPEL 9) rkhunter --update && rkhunter --propupd rkhunter --check --sk chkrootkit
See "How To Install Rootkit Hunter on CentOS 5 and 6" for details. chkrootkit often reports bindshell INFECTED (PORTS: 465) on mail servers; that is the normal SMTPS port.
Lynis: security audit
Lynis does not look for malware but checks your configuration and suggests hardening steps. See "VPS Security Audits Using Lynis".
Run scans automatically
# crontab -e (root) 0 3 * * * /usr/bin/clamscan -r -i /home > /var/log/clamscan-nightly.log 2>&1
Note: On cPanel servers, use the malware scanning built into your server's security tools, or ask our support team, instead of installing several scanners side by side.
