Malware Scanning with ClamAV and rkhunter on Linux

Linux malware exists, and the best defense is knowing what a clean system looks like so you can recognize a deviation. Two tools cover the bases differently: ClamAV scans file contents against a malware signature database, ideal for catching web shells and uploaded malicious files, while rkhunter compares your system against known-good values to spot rootkits and hidden modifications. Neither replaces a hardened baseline, but together they give a VPS a cheap, schedulable early-warning system.

Understand What Each Tool Actually Detects

ClamAV is a signature engine: it compares file contents against a database of known malware patterns. It is outstanding for the web-specific threats that matter on a VPS — PHP web shells that get uploaded through a vulnerable application, suspicious scripts dropped into a writable directory — and its daily-updated database means recently noticed malware becomes detectable quickly. rkhunter works on a completely different principle: it records hashes of core binaries, checks file properties, and looks for signs a rootkit has hidden things from the kernel. It detects infection by deviation from a baseline it captured when the system was clean, so its accuracy depends entirely on taking a trustworthy baseline.

Install and Configure ClamAV

On Debian and Ubuntu, clamav installs with a freshclam updater daemon that keeps the signature database current automatically. The default clamd config may need its scanning limits raised for large trees, and a socket or TCP endpoint is required for on-demand scanning via the clamdscan client.

sudo apt install -y clamav clamav-daemon
sudo freshclam
sudo systemctl enable --now clamav-freshclam
clamdscan --version

freshclam pulls the latest signature set on first run and on a schedule. Because a signature engine is only as good as its malware census, an out-of-date database is a false sense of security — keep the updater running and treat "signatures are stale" as an urgent condition, not a warning to ignore.

Scan the Dirs Web Attacks Deposit Into

The scan targets that matter on a web VPS are the upload directories and writable locations where files appear without a deploy. Point a scan at the document root, especially any sub-directory that accepts uploads, and at your web root generally. Run it with a recursive walk and a quarantine-capable handler so a hit is set aside rather than deleted on a false positive.

sudo clamscan -r -i /var/www/
sudo clamdscan -r /var/www/uploads

clamscan runs standalone and streams files directly; clamdscan is faster because it streams to the running clamd daemon. The -i flag reports only infected files, keeping a routine scan from flooding the log with thousands of clean-file lines. On large roots the difference between clamscan and clamdscan is real — the daemon avoids re-parsing the signature DB per file — so prefer the daemon-backed client for scheduled runs.

Set Up rkhunter With a Trustworthy Baseline

rkhunter's value depends on its baseline. Capture it on a freshly installed, fully patched system before the box faces untrusted traffic, and store the versioned properties in its database. Every change to a watched binary or config then stands out as a deviation rather than being silently accepted as the new normal.

sudo apt install -y rkhunter
sudo rkhunter --propupd
sudo rkhunter --check --sk
sudo nano /etc/rkhunter.conf

The --propupd refresh of scanned properties is the one-time baseline action. After that, every --check compares against it. For efficiency, /etc/rkhunter.conf holds investigation and update settings, and you set MIRROR_MODE and UPDATE_MIRRORS there so the tool can refresh its file-property database from a trusted source.

Read the Results: Warnings vs Findings

A scanner that cries wolf gets ignored; the skill is separating a true finding from configuration noise. rkhunter produces warnings for a variety of benign reasons — a package updated a binary, a source IP you changed, a suite of utilities it flags that you installed deliberately. Learn the difference between a warning and an actual "rootkit indicators found" result before you spend a night chasing noise.

sudo rkhunter --check --report-warnings-only
sudo grep -Ei "warning|found|infection" /var/log/rkhunter.log
sudo clamscan -r -i /var/www/ | grep -i found

For ClamAV, any "found" line with an infected file is actionable: quarantine it, identify how it got there, and check whether it is one of your own files matching a signature or genuine malware. For rkhunter, review the log's flagged items in order of severity, and investigate a changed core binary hash immediately while dismissing a one-off IP change after verification.

Automate Scans and Audit the Schedule

Manual scanning is the kind of task everyone promises and nobody sustains. a schedule is set up via cron or a systemd timer so the scan runs weekly and the result lands in a place you actually read. Combine the file scan with the rootkit check in one job, and log output so the trail exists even when nothing is wrong.

sudo crontab -e
# run weekly, report quietly, log everything
0 3 * * 1 clamscan -r -i /var/www/ >> /var/log/antivirus.log 2>&1
0 4 * * 1 rkhunter --check --sk >> /var/log/rkhunter.log 2>&1

With both jobs scheduled, you get a predictable weekly baseline of "clean" or a loud anomaly. The habit of scanning is more important than any single signature, because it is what surfaces the unexpected upload that made it past your application's filters.

Takeaway

ClamAV and rkhunter see different problems — signatures in files versus deviations from a clean baseline — and together they give a Linux VPS an affordable early-warning layer. Baseline once on a clean system, update signatures daily, scan the writable directories weekly, and treat every flagged deviation as worth an answer. A Netbay Ubuntu VPS gives you a fresh, patchable base where you can baseline rkhunter before any untrusted traffic arrives — netbayhosts.in.