Skip to main content
To scan a Linux server for malware, install ClamAV, update its signatures with freshclam, then run sudo clamscan -r -i /home /var/www /tmp to list infected files. To look for rootkits, install rkhunter, record a baseline with sudo rkhunter --propupd on a clean system, and run sudo rkhunter --check --sk. Treat every hit as a lead to check, not proof. ClamAV is a free antivirus engine that finds known malware, web shells and infected uploads by signature. rkhunter (Rootkit Hunter) and chkrootkit look for signs of rootkits: hidden tools that attackers install to keep access.

​
Before you start

  • You need root or a sudo user. Root users can leave out sudo.
  • A full scan reads every file and uses CPU and disk I/O. Run it outside your busy hours.
  • Scanners find known threats only. A clean result does not prove a server is safe. If you already suspect a break-in, read what to do if your Linux server is hacked first.

​
How to scan for malware with ClamAV

1

Install ClamAV

The clamav-freshclam service starts and keeps signatures up to date.
2

Update the virus signatures

The background service already updates them. To force an update now, stop it first so the two do not clash:
3

Scan the folders most often targeted

-r scans subfolders and -i prints only infected files.
4

Save the report

To keep a log and move infected files aside for review:
ClamAV’s own documentation warns against --remove, because false positives happen. Use --move or --copy and check each file yourself (ClamAV scanning documentation). To scan the whole disk, skip the virtual folders:

​
How to check it worked

The scan ends with a summary. The lines that matter:
Infected files: 0 means no known malware was found. Each hit is printed above the summary as the file path, the signature name and the word FOUND, for example /var/www/html/uploads/image.php: <signature name> FOUND. If the scan stops with No supported database files found, update the signatures first.

​
How to check for rootkits with rkhunter

1

Install rkhunter

2

Record a baseline

rkhunter compares system files with a stored list of their properties. Create that list while you trust the server, and again after each system update:
3

Run the check

--sk skips the “press Enter” pauses and --rwo prints warnings only. The full log is in /var/log/rkhunter.log.
Expect some warnings on a healthy server, such as “User ‘alex’ has been added to the passwd file” after you created a user, or warnings about hidden files that packages install. Read each one and compare it with changes you made.

​
How to run a second check with chkrootkit

chkrootkit is a separate, simpler rootkit scanner. On Ubuntu and Debian:
-q prints only suspicious results. It also lists harmless hidden files from installed packages, so review the paths before you act.

​
What should I do if a scanner finds something?

  1. Do not delete the file yet. Note its path, owner and time: ls -la /path/to/file and stat /path/to/file.
  2. Check whether it belongs to a package: dpkg -S /path/to/file (Ubuntu/Debian) or rpm -qf /path/to/file (AlmaLinux/Rocky).
  3. If it is a web shell or unknown program, assume the server is compromised and follow what to do if your Linux server is hacked.

​
Frequently asked questions

​
Is ClamAV enough to protect a Linux server?

No. ClamAV finds known malware files. Updates, a firewall, key-only SSH and backups stop most attacks before any file lands. See the Linux server hardening checklist.

​
Why does freshclam say it cannot lock the log file?

The clamav-freshclam service is already running and updating. Stop it, run sudo freshclam, then start it again, or just wait for the service.

​
How do I run a scan every night?

Add a cron job, for example 0 3 * * * clamscan -r -i --log=/var/log/clamscan-nightly.log /home /var/www in root’s crontab. See schedule tasks with cron.

​
Why does rkhunter warn about files after an update?

Updates change system binaries, so the stored properties no longer match. If you just ran updates from your distribution, run sudo rkhunter --propupd again.

VPS and dedicated server guides

Every guide in this section.

Server hacked?

Steps to recover safely.

Check login history

See who has logged in.

Find what is using CPU

Spot unknown processes.

Security checklist

Harden the rest of your server.
Checked against the official ClamAV documentation and the rkhunter and chkrootkit manuals on 4 November 2026; installation, clamscan options, rkhunter --propupd, rkhunter --check --sk --rwo and chkrootkit -q were tested on Ubuntu 24.04 LTS (ClamAV 1.5.4, rkhunter 1.4.6, chkrootkit 0.58b). Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026