Scan a Linux Server for Malware: ClamAV and rkhunter

You can check a Linux server for threats with two tools: ClamAV looks for malicious files by signature, while rkhunter hunts rootkits, replaced system binaries and suspicious settings. Below is how to install both, run a scan and read the results.

When to scan

Scan the server if you notice unusual load, outgoing spam, unknown processes, or after a break-in. A regular scheduled scan is good hygiene for any publicly reachable VPS.

Part 1. ClamAV, the antivirus

Installation

apt update
apt install -y clamav clamav-daemon

Updating the databases

Stop the update daemon, refresh manually, then start it again:

systemctl stop clamav-freshclam
freshclam
systemctl start clamav-freshclam

Running a scan

Scan the home directories and the web root recursively, printing only infected files:

clamscan -r -i /home /var/www

Useful flags:

• -r — recursive;
• -i — infected files only;
• --remove — delete what is found (use with care);
• --move=/root/quarantine — move to quarantine.

Moving to quarantine is safer than deleting:

mkdir -p /root/quarantine
clamscan -r -i --move=/root/quarantine /var/www

A quick full-system scan

clamscan -r -i --exclude-dir="^/sys" --exclude-dir="^/proc" /

/proc and /sys are virtual filesystems, so we skip them.

Part 2. rkhunter, the rootkit scanner

Installation

apt install -y rkhunter

Update and baseline snapshot

rkhunter --update
rkhunter --propupd

--propupd stores reference checksums of the system files. Run it only on a system you know is clean.

Running the check

rkhunter --check --skip-keypress

rkhunter inspects system binaries, known rootkits, file permissions, hidden processes and ports. The full result goes to /var/log/rkhunter.log.

To see the warnings only:

grep -i warning /var/log/rkhunter.log

Reading the warnings

Not every warning means an infection. Common false positives come from updated packages (checksums changed) and hidden files such as /dev/.udev. After a legitimate system update, run rkhunter --propupd again to refresh the baseline.

Extra: chkrootkit

A second rootkit scanner for a cross-check:

apt install -y chkrootkit
chkrootkit

Automating with cron

A weekly check with an emailed report. Create /etc/cron.weekly/security-scan:

#!/bin/bash
freshclam
clamscan -r -i /var/www /home >> /var/log/clamscan.log
rkhunter --update
rkhunter --check --skip-keypress --report-warnings-only

Make it executable:

chmod +x /etc/cron.weekly/security-scan

What to do if something is found

1. Isolate the server — restrict outgoing traffic in the firewall.
2. Do not destroy the evidence right away; take a snapshot or a backup first.
3. Check the running processes (ps aux), the connections (ss -tulpn) and the cron jobs.
4. For a serious compromise the safest path is a clean reinstall from a known-good image plus a restore from a verified backup.

Verifying package integrity

Compromises often replace system binaries. On Debian/Ubuntu, verify the checksums of installed packages:

apt install -y debsums
debsums -s

The output lists files whose checksums do not match the package. On RPM systems the equivalent is rpm -Va.

Auditing open ports and processes

Malware usually leaves a listening port or a hidden process behind. Check manually:

ss -tulpn
ps auxf

Suspicious outgoing connections:

ss -tp state established

Review the scheduler entries, a favourite hiding place for persistence:

crontab -l
ls -la /etc/cron.* /etc/cron.d
cat /etc/crontab

Checking startup items and users

New or unknown users with UID 0 are a red flag:

awk -F: '($3 == 0) {print}' /etc/passwd

List the enabled systemd services:

systemctl list-unit-files --state=enabled

Look for units with odd names or start paths in /tmp or /dev/shm.

Regularity beats a one-off scan

A single scan only catches what has already got in. Real protection is routine: a weekly cron scan (the example above), current system updates (apt update && apt upgrade), a firewall, SSH password login disabled and fresh backups on separate storage.

Frequently asked questions

ClamAV or rkhunter — which one? Both. ClamAV looks for malicious files, rkhunter for rootkits and replaced binaries. They complement each other.

Are lots of rkhunter warnings normal? Yes, especially after package updates. Refresh the baseline with rkhunter --propupd on a clean system.

Does scanning load the server? A full disk scan loads the CPU and disk I/O. Schedule it for off-peak hours.

Can I trust ClamAV’s --remove? Be careful: false positives happen. Prefer --move to quarantine and a manual review.

Does this guarantee the server is clean? No tool gives a 100% guarantee. Keep backups and keep the system updated — that is the foundation of security.

Security starts with the right infrastructure. Take a VPS for security and VPN or a standard VPS plan. Regular audits and hardening can be set up by Server administration.