> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Scan a Linux Server for Malware with ClamAV and rkhunter

> To scan a Linux server for malware, run ClamAV with sudo clamscan -r -i /home /var/www and check for rootkits with sudo rkhunter --check --sk.

To scan a Linux server for malware, install ClamAV, update its signatures with `freshclam`, then run `sudo clamscan -r -i /home /var/www /tmp` to list infected files. To look for rootkits, install rkhunter, record a baseline with `sudo rkhunter --propupd` on a clean system, and run `sudo rkhunter --check --sk`. Treat every hit as a lead to check, not proof.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 20–60 minutes (depends on disk size) | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 (EPEL) | Root or sudo access |

ClamAV is a free antivirus engine that finds known malware, web shells and infected uploads by signature. rkhunter (Rootkit Hunter) and chkrootkit look for signs of rootkits: hidden tools that attackers install to keep access.

## Before you start

* You need root or a sudo user. Root users can leave out `sudo`.
* A full scan reads every file and uses CPU and disk I/O. Run it outside your busy hours.
* Scanners find known threats only. A clean result does not prove a server is safe. If you already suspect a break-in, read [what to do if your Linux server is hacked](https://help.freakhosting.com/portals/other/what-to-do-if-your-linux-server-is-hacked.md) first.

## How to scan for malware with ClamAV

**1. Install ClamAV**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt update
> sudo apt install clamav clamav-daemon
> ```
>
> The `clamav-freshclam` service starts and keeps signatures up to date.

> [tab] AlmaLinux / Rocky
>
> ClamAV is in EPEL.
>
> ```bash theme={null}
> sudo dnf install epel-release
> sudo dnf install clamav clamav-freshclam
> ```

**2. Update the virus signatures**

> [tab] Ubuntu / Debian
>
> The background service already updates them. To force an update now, stop it first so the two do not clash:
>
> ```bash theme={null}
> sudo systemctl stop clamav-freshclam
> sudo freshclam
> sudo systemctl start clamav-freshclam
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo freshclam
> ```

**3. Scan the folders most often targeted**

```bash theme={null}
sudo clamscan -r -i /home /var/www /tmp /var/tmp
```

`-r` scans subfolders and `-i` prints only infected files.

**4. Save the report**

To keep a log and move infected files aside for review:

```bash theme={null}
sudo mkdir -p /root/quarantine
sudo clamscan -r -i --move=/root/quarantine --log=/root/clamscan.log /home /var/www
```

ClamAV's own documentation warns against `--remove`, because false positives happen. Use `--move` or `--copy` and check each file yourself ([ClamAV scanning documentation](https://docs.clamav.net/manual/Usage/Scanning.html)).

To scan the whole disk, skip the virtual folders:

```bash theme={null}
sudo clamscan -r -i --exclude-dir="^/proc" --exclude-dir="^/sys" --exclude-dir="^/dev" /
```

## How to check it worked

The scan ends with a summary. The lines that matter:

```text theme={null}
----------- SCAN SUMMARY -----------
Scanned directories: 1832
Scanned files: 24410
Infected files: 0
```

`Infected files: 0` means no known malware was found. Each hit is printed above the summary as the file path, the signature name and the word `FOUND`, for example `/var/www/html/uploads/image.php: <signature name> FOUND`. If the scan stops with `No supported database files found`, update the signatures first.

## How to check for rootkits with rkhunter

**1. Install rkhunter**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt install rkhunter
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo dnf install epel-release
> sudo dnf install rkhunter
> ```

**2. Record a baseline**

rkhunter compares system files with a stored list of their properties. Create that list while you trust the server, and again after each system update:

```bash theme={null}
sudo rkhunter --propupd
```

**3. Run the check**

```bash theme={null}
sudo rkhunter --check --sk --rwo
```

`--sk` skips the "press Enter" pauses and `--rwo` prints warnings only. The full log is in `/var/log/rkhunter.log`.

Expect some warnings on a healthy server, such as "User 'alex' has been added to the passwd file" after you created a user, or warnings about hidden files that packages install. Read each one and compare it with changes you made.

## How to run a second check with chkrootkit

chkrootkit is a separate, simpler rootkit scanner. On Ubuntu and Debian:

```bash theme={null}
sudo apt install chkrootkit
sudo chkrootkit -q
```

`-q` prints only suspicious results. It also lists harmless hidden files from installed packages, so review the paths before you act.

## What should I do if a scanner finds something?

1. Do not delete the file yet. Note its path, owner and time: `ls -la /path/to/file` and `stat /path/to/file`.
2. Check whether it belongs to a package: `dpkg -S /path/to/file` (Ubuntu/Debian) or `rpm -qf /path/to/file` (AlmaLinux/Rocky).
3. If it is a web shell or unknown program, assume the server is compromised and follow [what to do if your Linux server is hacked](https://help.freakhosting.com/portals/other/what-to-do-if-your-linux-server-is-hacked.md).

## Frequently asked questions

### Is ClamAV enough to protect a Linux server?

No. ClamAV finds known malware files. Updates, a firewall, key-only SSH and backups stop most attacks before any file lands. See the [Linux server hardening checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md).

### Why does freshclam say it cannot lock the log file?

The `clamav-freshclam` service is already running and updating. Stop it, run `sudo freshclam`, then start it again, or just wait for the service.

### How do I run a scan every night?

Add a cron job, for example `0 3 * * * clamscan -r -i --log=/var/log/clamscan-nightly.log /home /var/www` in root's crontab. See [schedule tasks with cron](https://help.freakhosting.com/portals/other/how-to-schedule-tasks-with-cron.md).

### Why does rkhunter warn about files after an update?

Updates change system binaries, so the stored properties no longer match. If you just ran updates from your distribution, run `sudo rkhunter --propupd` again.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Server hacked?](https://help.freakhosting.com/portals/other/what-to-do-if-your-linux-server-is-hacked.md)
>
> Steps to recover safely.

> [card] [Check login history](https://help.freakhosting.com/portals/other/how-to-check-who-is-logged-in-and-login-history.md)
>
> See who has logged in.

> [card] [Find what is using CPU](https://help.freakhosting.com/portals/other/how-to-find-what-is-using-cpu-on-linux.md)
>
> Spot unknown processes.

> [card] [Security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the rest of your server.

***

> [!NOTE]
>
> **Checked against the official [ClamAV documentation](https://docs.clamav.net/manual/Usage/Scanning.html) and the rkhunter and chkrootkit manuals** on 4 November 2026; installation, `clamscan` options, `rkhunter --propupd`, `rkhunter --check --sk --rwo` and `chkrootkit -q` were tested on Ubuntu 24.04 LTS (ClamAV 1.5.4, rkhunter 1.4.6, chkrootkit 0.58b). Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.