ClamAV and Linux Malware Detect (maldet) look for files on a server that match known malware signatures: web shells, backdoors, droppers and phishing pages. This is a useful layer of protection for PHP sites, but it does not guarantee a clean system. Below you will find what these tools catch, how to scan a site directory and review the quarantine, and why a single scanner is not enough.
What ClamAV and Maldet can and cannot do
ClamAV is a general-purpose antivirus engine with open signatures. Maldet was built for shared hosting and web servers: its database is based on real website infections, and it can use ClamAV as a fast scanning engine. Together they cover the typical cases, but both have limits.
| Tool | What it finds | What it misses |
|---|---|---|
| clamscan / clamdscan | Known viruses, some PHP shells, infected documents | Fresh or obfuscated code without a signature |
| maldet | Web shells and injections typical for CMS | Unique backdoors, changes in the database |
| rkhunter | Rootkits and replaced system files | Malicious code inside the website |
Installing ClamAV and updating signatures
On Debian and Ubuntu the packages come from the standard repositories. The clamav-freshclam service pulls fresh signatures by itself. To update the database manually, stop the service first, otherwise freshclam cannot obtain the database lock.
apt update
apt install -y clamav clamav-daemon
systemctl status clamav-freshclam
systemctl stop clamav-freshclam
freshclam
systemctl start clamav-freshclamThe clamd daemon keeps the signature database in memory and therefore takes a noticeable amount of RAM. On a small VPS this matters: it is easier to run a one-off clamscan on a schedule than to keep the daemon running all the time.
Scanning a site directory
For a one-off check, clamscan is enough. It loads the database on every run, so it is slower, but it needs no daemon. The exit code shows the result: 0 means nothing found, 1 means infected files were found, 2 means an error. This is convenient for cron and scripts.
mkdir -p /var/quarantine
clamscan -r -i --log=/var/log/clamscan.log --move=/var/quarantine /var/www/example.com
echo $?
clamdscan --multiscan --fdpass /var/www/example.com- The -r option scans the directory recursively, and -i prints only infected files.
- The --move option relocates findings to a quarantine directory that you must create in advance.
- clamdscan is faster because it works through the daemon, and --fdpass passes an open file descriptor, so the daemon has no permission problems.
Maldet: installation, scanning and quarantine
Maldet is installed from the maldetect-current.tar.gz archive on the project site; the installer creates the /usr/local/maldetect directory and a daily cron job. Every scan gets a SCANID, which you use to view the report and to work with the quarantine. If ClamAV is installed, maldet picks it up as an engine.
cd /usr/local/src
tar xzf maldetect-current.tar.gz
cd maldetect-*
./install.sh
maldet -u
maldet -a /var/www/example.com
maldet -r /var/www/example.com 2
maldet --report SCANID
maldet -q SCANID
maldet -s SCANID
maldet -lSettings live in /usr/local/maldetect/conf.maldet. The quarantine_hits=1 parameter enables automatic quarantine, while email_alert=1 and email_addr send the report by email. Quarantined files are stored in /usr/local/maldetect/quarantine, and the event log is in /usr/local/maldetect/logs/event_log. Before restoring a file (the -s option), make sure it is not a false positive.
Why signatures alone are not enough
A signature scanner sees only what is already known. Attackers modify and encrypt code so that it does not match the database, so a clean report does not mean a safe server. Scanning is one measure, not a replacement for the others.
- Compare CMS files with a reference: for WordPress, use the wp core verify-checksums command.
- Watch file permissions and owners, and forbid PHP execution in upload directories.
- Keep backups outside the server so a clean state can always be restored.
- Do not delete findings right away: keep a copy for analysis and find out how the code got onto the server.
If the scanner finds something, follow the plan in the article on diagnosing, cleaning and restoring a hacked site. To check the system itself for rootkits, use rkhunter and chkrootkit, and the Linux server security checklist puts all the measures together.
Frequently asked questions
Do I need antivirus on a Linux server with a website?
Viruses for the Linux system itself are rare, but a PHP site remains a target: a vulnerable plugin lets web shells and phishing pages onto the server. A ClamAV or maldet scan helps find such files, but it works as a complement to updates and tight permissions, not as a replacement for them.
How is maldet different from ClamAV?
ClamAV is a general antivirus engine, while maldet targets web servers: its signatures come from real website infections, and it offers quarantine, reports and monitoring of changed files. The tools do not compete: maldet can use ClamAV as a fast engine, and together they find more than either one alone.
How often should I scan the site directory?
A daily cron check is enough, and after plugin updates or suspicious events it is worth running a manual scan. For large directories, check only recently modified files, for example with maldet -r and a number of days, so that the scan does not overload the disk and the processor of the server.
What if the scanner finds nothing but the site behaves strangely?
No findings do not prove the site is clean: the code may be obfuscated or stored in the database. Compare CMS files with a reference, review the web server logs, and check recently modified files and user accounts. If a compromise is confirmed, move on to the recovery procedure immediately.