How to Scan a Linux Server for Malware (rkhunter, ClamAV)

Prevention is the priority, but detection matters too — no server is perfectly secure, and knowing quickly if something got in limits the damage. This guide sets up two complementary scanners on Linux: rkhunter for rootkits and suspicious system changes, and ClamAV for known malware files. It also covers how to read results without panicking at every false positive.

Two tools, two jobs

• rkhunter (Rootkit Hunter) checks for rootkits, backdoors, and local exploits by comparing system files against known-good hashes and scanning for suspicious patterns.
• ClamAV is an antivirus engine that scans files against a signature database — useful for catching malware in uploads, web directories, and mail.

Neither replaces hardening. Do the fundamentals first: firewall, SSH keys, and automatic updates.

Install and run rkhunter

sudo apt update
sudo apt install rkhunter -y

Update its data files, then establish a baseline of your current (assumed-clean) system:

sudo rkhunter --update
sudo rkhunter --propupd

Run a full check:

sudo rkhunter --check --sk

The --sk (skip keypress) flag lets it run non-interactively. Results are logged to /var/log/rkhunter.log.

{{SCREENSHOT}}

Read rkhunter results calmly

rkhunter flags "Warnings" liberally — many are benign (a config file legitimately changed after an update). Investigate each warning against /var/log/rkhunter.log, but don't assume a warning equals a compromise. After a deliberate system change, re-run --propupd to update the baseline. What you're really watching for is *unexpected* changes you can't explain.

Install and run ClamAV

sudo apt install clamav clamav-daemon -y

Update signatures (the freshclam service usually does this automatically, so stop it first if it complains):

sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam

Scan a directory recursively, printing only infected files:

clamscan -r -i /var/www

For a full-system scan (slow), point it at / and exclude virtual filesystems:

sudo clamscan -r -i --exclude-dir="^/sys|^/proc|^/dev" /

Schedule regular scans

Detection only helps if it runs. Add a weekly cron job:

0 2 * * 0 /usr/bin/rkhunter --check --sk --report-warnings-only
0 3 * * 0 /usr/bin/clamscan -r -i /var/www /home

Route the output to email or a log you actually read. Pair it with monitoring and journalctl for a fuller picture.

What to do on a real detection

If you find genuine malware or an unexplained rootkit warning, assume the whole system is untrustworthy:

1. Isolate: cut the server off with the firewall or your provider's network controls.
2. Investigate from outside: don't trust on-box tools that may be compromised.
3. Rebuild, don't clean: the safest recovery is a fresh server, restoring only known-good data from backups, then rotating all secrets.

Real-time scanning for web-facing servers

If your server accepts file uploads — a WordPress media library, a user avatar form, a document portal — you want to catch malicious files as they arrive, not a week later in a scheduled scan. ClamAV's daemon mode makes on-demand scanning fast because signatures stay loaded in memory:

sudo systemctl enable --now clamav-daemon
clamdscan /var/www/uploads/newfile.pdf

You can wire clamdscan into your application's upload handler so every incoming file is checked before it's stored or served. For mail servers, ClamAV integrates with the mail pipeline to reject infected attachments outright. The key idea is moving detection as close to the entry point as possible, so malware is stopped before it can be executed or passed on to your users.

Watch for the subtler signs of compromise

Scanners catch known malware, but a careful attacker leaves quieter traces. Build the habit of noticing them:

• Unexpected processes or high load with no obvious cause — check htop and ps aux.
• Unknown listening ports — sudo ss -tulnp reveals a backdoor waiting for connections.
• Odd outbound traffic, especially to unfamiliar hosts, which can indicate a bot phoning home.
• New cron jobs or systemd services you didn't create — a classic persistence trick.
• Modified system binaries — exactly what rkhunter's baseline comparison is designed to flag.

Correlate anything suspicious with your logs and monitoring baseline. Detection isn't a single tool — it's the combination of automated scanners and a rough sense of what "normal" looks like, so a deviation catches your eye. The earlier you notice, the smaller the cleanup.

FAQ

Do I need antivirus on Linux?

Linux servers are less targeted by traditional viruses, but ClamAV is genuinely useful for scanning user uploads, web content, and mail for malware that could harm your users or spread.

Are rkhunter warnings something to worry about?

Often not — many are benign changes from updates. Establish a baseline with --propupd, then investigate only *unexplained* changes. Context matters.

How often should I scan?

Weekly automated scans are a sensible baseline, plus an on-demand scan any time you suspect something. Detection is only useful if it actually runs.

My server was compromised — can I just clean it?

It's far safer to rebuild from scratch and restore known-good data than to try to clean a compromised system. You can never be fully sure a rootkit is gone.

A practical scanning routine

Detection works best as a light, regular habit rather than a one-off panic:

• Establish an rkhunter baseline with --propupd on a known-clean system, then re-run it after deliberate changes.
• Scan weekly with rkhunter (--check --sk) and ClamAV (clamscan -r -i) via cron, output routed somewhere you'll read.
• Scan uploads in real time on web-facing servers using the ClamAV daemon.
• Investigate warnings in context — many rkhunter warnings are benign changes; chase the unexplained ones.
• Watch the quiet signs — unknown listening ports, unexpected processes, new cron jobs or services.
• On a real detection, rebuild rather than clean, restore known-good data, and rotate every secret.

The mindset that matters: scanning doesn't replace hardening, it complements it. The fundamentals (firewall, keys, updates) keep attackers out; scanning and a rough sense of "normal" tell you quickly if something got in anyway. The sooner you notice, the smaller the cleanup — and knowing you'll rebuild from tested backups rather than trust a compromised box makes recovery a decision, not a scramble.

Scanning is your safety net beneath a well-hardened server. Run both on a VPS with full root access — see Nxeon VPS hosting and our security page.