Applies to: Debian, Ubuntu, CentOS, and other Linux distributions.
Task
Install antivirus utilities and scan the server for malicious code.
Solution
This article covers two antivirus utilities: ClamAV and Maldet (Linux Malware Detect).
ClamAV
To install ClamAV on Debian/Ubuntu, run:
sudo apt-get install clamav
To install ClamAV on CentOS, run:
sudo yum install clamav
Basic ClamAV commands
Update the virus database:
sudo freshclam
Scan a directory:
sudo clamscan -r /path/to/directory
Show only infected files (using the -i flag):
sudo clamscan -ir /path/to/directory
Move infected files to a separate folder for later removal:
sudo mkdir /infected_files
sudo clamscan -ir / --move=/infected_files
Delete the moved files:
sudo rm -rf /infected_files/*
For a full reference on ClamAV, run:
man clamav
Maldet (Linux Malware Detect)
To install Maldet on Linux systems, run the following commands:
cd /tmp
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar xfz maldetect-current.tar.gz
cd maldetect-*
./install.sh
Update Maldet:
maldet --update-ver
maldet --update
Run a scan:
maldet -a /path/to/directory
Example scan output
Dec 05 03:10:20 s1 maldet(6666): {scan} file list completed, found 8095432 files...
Dec 05 03:10:20 s1 maldet(6666): {scan} found ClamAV clamscan binary, using as scanner engine...
Dec 05 03:10:20 s1 maldet(6666): {scan} scan of /var/www (8095432 files) in progress...
Dec 05 03:29:14 s1 maldet(6666): {scan} scan completed on /var/www: files 8095432, malware hits 18, cleaned hits 0
Dec 05 03:29:14 s1 maldet(6666): {scan} scan report saved, to view run: maldet --report 102814-0358.6666
Dec 05 03:29:14 s1 maldet(6666): {scan} quarantine is disabled! set quar_hits=1 in conf.maldet or to quarantine results run: maldet -q 102814-0358.6666
