Malware Scanning with Maldet and ClamAV

6 min read

Linux Malware Detect (maldet) finds PHP backdoors, web shells, spam injectors, and other malware that targets web-facing servers. It was built for shared hosting but works the same way on a VPS. ClamAV adds signature-based scanning on top of maldet’s pattern matching, so install both.

Prerequisites link

• A GoZen Host VPS or cloud server with root access
• Ubuntu 22.04/24.04, Debian 12, Rocky Linux 9, or AlmaLinux 9
• Basic familiarity with the command line (Essential Linux Commands)

Install ClamAV link

Install ClamAV first. Maldet uses it as a scanning engine when available. Without ClamAV, scans are slower and catch less.

  sudo apt update
sudo apt install clamav clamav-daemon -y
  

  sudo dnf install epel-release -y
sudo dnf install clamav clamd clamav-update -y
  

Update the virus definitions:

  sudo systemctl stop clamav-freshclam   # stop the daemon so we can update manually
sudo freshclam                         # download latest signatures
sudo systemctl start clamav-freshclam  # restart automatic updates
  

Verify ClamAV is working:

  clamscan --version
# Expected: ClamAV 1.x.x/27xxx/...
  

Install Maldet link

Maldet installs from source. There’s no distro package.

  cd /tmp
wget https://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzf maldetect-current.tar.gz
cd maldetect-*
sudo sh install.sh
  

The installer:

• Puts maldet at /usr/local/maldetect/
• Creates a symlink at /usr/local/sbin/maldet
• Adds a daily cron job at /etc/cron.daily/maldet
• On systemd servers, installs and enables maldet.service for real-time monitoring

Verify the install:

  maldet --version
  

Configure Maldet link

Edit the main configuration file:

  sudo nano /usr/local/maldetect/conf.maldet
  

Change these from the defaults:

  # Email alerts when malware is found
email_alert="1"
email_addr="[email protected]"

# Quarantine malware hits automatically
quarantine_hits="1"

# Try to clean detected malware (remove injected code)
quarantine_clean="1"

# Suspend the cPanel user who owns the infected file
# Set to 0 unless you're running a shared hosting server
quarantine_suspend_user="0"
  

Older guides use quar_hits, quar_clean and quar_susp. Current maldet ignores those names, so use the quarantine_ ones above.

Check that these defaults are still set:

  # Use ClamAV as the scan engine (much faster than maldet's built-in scanner)
scan_clamscan="1"

# Scan files up to 2MB (increase if your app has larger PHP files)
scan_max_filesize="2048k"
  

Save and close.

Update Malware Signatures link

Always update before your first scan:

  sudo maldet -u    # update malware signatures
sudo maldet -d    # check for maldet software updates
  

Set up a cron job to update signatures daily. The installer creates one at /etc/cron.daily/maldet, but verify it exists:

  ls -la /etc/cron.daily/maldet
  

Scan Your Server link

Full Directory Scan link

Scan your web root or any directory:

  # Scan all web files
sudo maldet -a /home/

# Scan a specific user's site
sudo maldet -a /home/username/public_html/
  

Scan Recently Modified Files link

Only scan files changed in the last 7 days. Much faster than a full scan:

  sudo maldet -r /home/ 7
  

Background Scan link

For large directories, run the scan in the background:

  sudo maldet -b -a /home/
  

Check progress:

  ps aux | grep maldet
  

Read Scan Reports link

After a scan completes, maldet shows a scan ID. Use it to view the full report:

  # List all scan reports
sudo maldet --report list

# View a specific report
sudo maldet --report SCAN-ID
  

A report shows:

• Total files scanned
• Total hits (malware found)
• File paths of infected files
• Malware signatures matched
• Quarantine status

Manage Quarantined Files link

When quarantine_hits="1" is set, infected files are moved to /usr/local/maldetect/quarantine/. They can’t run from there.

View Quarantined Files link

  ls -la /usr/local/maldetect/quarantine/
  

Restore a False Positive link

If maldet quarantined a legitimate file:

  sudo maldet --restore FILENAME
  

Or restore all hits from a specific scan:

  sudo maldet --restore SCAN-ID
  

Manually Quarantine a Scan’s Hits link

If you ran a scan without auto-quarantine:

  sudo maldet -q SCAN-ID
  

Real-Time Monitoring with inotify link

Maldet can watch directories in real time using inotify. Any file that’s created or modified gets scanned on the spot.

Start Monitoring link

  sudo maldet -m /home/
  

This runs as a background process. Check that it’s active:

  ps aux | grep inotifywait
  

Stop Monitoring link

  sudo maldet -k
  

Start on Boot link

The installer already adds and enables maldet.service, which starts the monitor using the default_monitor_mode setting in conf.maldet (default users, which watches users’ web folders). To watch specific paths instead, list them in /usr/local/maldetect/monitor_paths (one per line, for example /home) and set:

  default_monitor_mode="/usr/local/maldetect/monitor_paths"
  

Then restart the service:

  sudo systemctl restart maldet
sudo systemctl status maldet
  

Don’t create a second systemd unit for the monitor. Two monitors would fight over the same PID file.

  echo "fs.inotify.max_user_watches=524288" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
  

Maldet vs cPGuard link

GoZen shared hosting servers run Imunify360 or cPGuard. This is how maldet compares with cPGuard:

On a VPS, maldet + ClamAV covers file-level malware detection. You still need Fail2Ban for brute-force blocking and a firewall for network-level filtering.

Troubleshooting link

What to Do Next link

• Server Hardening Basics: Fail2Ban, sysctl, and SSH hardening alongside maldet
• How to Set Up a Firewall (UFW and CSF): network-level protection
• VPS Security Checklist: the full first-boot security walkthrough
• Using cPGuard: if you’re on shared hosting, cPGuard already handles this
• Securing WordPress: application-level hardening for WordPress sites