Malware Scanning with Maldet and ClamAV

Linux Malware Detect (maldet) finds PHP backdoors, web shells, spam injectors, and other malware that targets web-facing servers. It was built for shared hosting but works the same way on a VPS. ClamAV adds signature-based scanning on top of maldet’s pattern matching, so install both.

Prerequisites link

• A GoZen Host VPS or cloud server with root access
• Ubuntu 22.04/24.04, Debian 12, Rocky Linux 9, or AlmaLinux 9
• Basic familiarity with the command line (Essential Linux Commands)

Install ClamAV link

Install ClamAV first. Maldet uses it as a scanning engine when available. Without ClamAV, scans are slower and catch less.

  sudo apt update
sudo apt install clamav clamav-daemon -y
  

  sudo dnf install epel-release -y
sudo dnf install clamav clamd clamav-update -y
  

Update the virus definitions:

  sudo systemctl stop clamav-freshclam   # stop the daemon so we can update manually
sudo freshclam                         # download latest signatures
sudo systemctl start clamav-freshclam  # restart automatic updates
  

Verify ClamAV is working:

  clamscan --version
# Expected: ClamAV 1.x.x/27xxx/...
  

Install Maldet link

Maldet installs from source. There’s no distro package.

  cd /tmp
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzf maldetect-current.tar.gz
cd maldetect-*
sudo sh install.sh
  

The installer:

• Puts maldet at /usr/local/maldetect/
• Creates a symlink at /usr/local/sbin/maldet
• Adds a daily cron job at /etc/cron.daily/maldet

Verify the install:

  maldet --version
  

Configure Maldet link

Edit the main configuration file:

  sudo nano /usr/local/maldetect/conf.maldet
  

Change these from the defaults:

  # Email alerts when malware is found
email_alert="1"
email_addr="admin@yourdomain.com"

# Quarantine malware hits automatically
quar_hits="1"

# Try to clean detected malware (remove injected code)
quar_clean="1"

# Suspend the cPanel user who owns the infected file
# Set to 0 unless you're running a shared hosting server
quar_susp="0"

# Use ClamAV as the scan engine (much faster than maldet's built-in scanner)
scan_clamscan="1"

# Scan files up to 2MB (increase if your app has larger PHP files)
scan_max_filesize="2048k"

# Monitor these file extensions during real-time scanning
scan_hexfifo_ext="htm,html,php,js,txt,py,pl,sh"
  

Save and close.

Update Malware Signatures link

Always update before your first scan:

  sudo maldet -u    # update malware signatures
sudo maldet -d    # check for maldet software updates
  

Set up a cron job to update signatures daily. The installer creates one at /etc/cron.daily/maldet, but verify it exists:

  ls -la /etc/cron.daily/maldet
  

Scan Your Server link

Full Directory Scan link

Scan your web root or any directory:

  # Scan all web files
sudo maldet -a /home/

# Scan a specific user's site
sudo maldet -a /home/username/public_html/
  

Scan Recently Modified Files link

Only scan files changed in the last 7 days. Much faster than a full scan:

  sudo maldet -r /home/ 7
  

Background Scan link

For large directories, run the scan in the background:

  sudo maldet -b -a /home/
  

Check progress:

  ps aux | grep maldet
  

Read Scan Reports link

After a scan completes, maldet shows a scan ID. Use it to view the full report:

  # List all scan reports
sudo maldet --report list

# View a specific report
sudo maldet --report SCAN-ID
  

A report shows:

• Total files scanned
• Total hits (malware found)
• File paths of infected files
• Malware signatures matched
• Quarantine status

Manage Quarantined Files link

When quar_hits="1" is set, infected files are moved to /usr/local/maldetect/quarantine/. They can’t run from there.

View Quarantined Files link

  ls -la /usr/local/maldetect/quarantine/
  

Restore a False Positive link

If maldet quarantined a legitimate file:

  sudo maldet --restore FILENAME
  

Or restore all hits from a specific scan:

  sudo maldet --restore SCAN-ID
  

Manually Quarantine a Scan’s Hits link

If you ran a scan without auto-quarantine:

  sudo maldet -q SCAN-ID
  

Real-Time Monitoring with inotify link

Maldet can watch directories in real time using inotify. Any file that’s created or modified gets scanned on the spot.

Start Monitoring link

  sudo maldet -m /home/
  

This runs as a background process. Check that it’s active:

  ps aux | grep inotifywait
  

Stop Monitoring link

  sudo maldet -k
  

Start on Boot link

Add the monitor command to a systemd service or /etc/rc.local:

  sudo nano /etc/systemd/system/maldet-monitor.service
  

  [Unit]
Description=Linux Malware Detect Real-Time Monitor
After=network.target

[Service]
Type=forking
ExecStart=/usr/local/sbin/maldet -m /home/
ExecStop=/usr/local/sbin/maldet -k
Restart=on-failure

[Install]
WantedBy=multi-user.target
  

  sudo systemctl daemon-reload
sudo systemctl enable maldet-monitor
sudo systemctl start maldet-monitor
  

  echo "fs.inotify.max_user_watches=524288" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
  

Maldet vs cPGuard link

If you’re on GoZen shared hosting, you already have cPGuard. Here’s how they compare:

On a VPS, maldet + ClamAV covers file-level malware detection. You still need Fail2Ban for brute-force blocking and a firewall for network-level filtering.

Troubleshooting link

What to Do Next link

• Server Hardening Basics: Fail2Ban, sysctl, and SSH hardening alongside maldet
• How to Set Up a Firewall (UFW and CSF): network-level protection
• VPS Security Checklist: the full first-boot security walkthrough
• Using cPGuard: if you’re on shared hosting, cPGuard already handles this
• Securing WordPress: application-level hardening for WordPress sites