What Linux Malware Detect does

Linux Malware Detect, also called LMD or maldet, is a free malware scanner from R-fx Networks. It is written for shared hosting servers, so its signatures focus on the threats found in websites: PHP web shells, backdoors, mailers, defacement scripts and injected code. It can:

• Scan folders on demand, or only files changed in the last few days.
• Run a daily scan from cron and email you the results.
• Quarantine infected files, or try to clean some types of injected code.
• Use ClamAV’s scan engine for faster scans, when ClamAV is installed.
• Watch folders in real time with inotify, if you turn on monitoring mode.

LMD complements other tools. ClamAV covers email and general malware, and rkhunter checks the system itself for rootkits.

Before you start

• ✓ Root access to a VPS or dedicated server. LMD cannot be installed on a shared hosting account.
• ✓ A recent backup of the websites, in case you need to restore a cleaned file.
• ✓ ClamAV installed, ideally. On cPanel, install it from WHM first.
• ✓ A working mail setup, if you want email alerts.

Option 1: the one-command helper

The helper script downloads and installs LMD, sets your alert email, keeps it in report-only mode, links cPanel’s ClamAV if it is installed, and updates the signatures. Report-only mode means nothing is moved until you decide.

1. Save the script below as lmd-setup.sh on the server, for example in /root.
2. Check the current status. This changes nothing:

sudo bash lmd-setup.sh check

3. Install LMD with your email address. The script asks you to type YES first:

sudo bash lmd-setup.sh install you@example.com

The helper script

Read the script before you run it. It downloads only the LMD archive from R-fx Networks.

#!/usr/bin/env bash
# lmd-setup.sh
# Installs Linux Malware Detect (LMD, maldet) from R-fx Networks, sets the alert email,
# keeps it in report-only mode, links cPanel's ClamAV if present, and updates the signatures.
#
# Usage (run as root):
#   sudo bash lmd-setup.sh check                     report status. Changes nothing. Default.
#   sudo bash lmd-setup.sh install you@example.com   install and set up. Asks for confirmation.

set -u

MODE="${1:-check}"
EMAIL="${2:-root}"
URL="https://www.rfxn.com/downloads/maldetect-current.tar.gz"
CONF=/usr/local/maldetect/conf.maldet

say()  { printf '%s\n' "$*"; }
have() { command -v "$1" >/dev/null 2>&1; }

if [ "$(id -u)" -ne 0 ]; then
  say "Run this script as root (sudo bash lmd-setup.sh $MODE)."
  exit 1
fi

say "== Status =="
if have maldet; then
  maldet --help 2>/dev/null | head -n 2
  [ -f "$CONF" ] && grep -E '^(email_alert|email_addr|quarantine_hits|scan_clamscan)=' "$CONF"
else
  say "LMD (maldet) is not installed."
fi
if [ -x /usr/local/cpanel/3rdparty/bin/clamscan ] || have clamscan; then
  say "ClamAV: found (LMD will use its scan engine)."
else
  say "ClamAV: not found (LMD will use its own, slower engine)."
fi

[ "$MODE" = "check" ] && exit 0
if [ "$MODE" != "install" ]; then
  say "Unknown mode: $MODE. Use check or install."
  exit 1
fi

say ""
say "This will download LMD from $URL, install it in /usr/local/maldetect,"
say "send alerts to $EMAIL, keep it in report-only mode (no automatic quarantine)"
say "and update its signatures."
printf 'Type YES to continue: '
read -r ANSWER
if [ "$ANSWER" != "YES" ]; then
  say "Stopped. Nothing was changed."
  exit 0
fi

WORK="$(mktemp -d)"
cd "$WORK" || exit 1
if ! curl -fsSL -o maldetect-current.tar.gz "$URL"; then
  say "Download failed. Nothing was installed."
  exit 1
fi
tar -xzf maldetect-current.tar.gz
cd maldetect-*/ || { say "Unexpected archive layout. Nothing was installed."; exit 1; }
./install.sh

if [ ! -f "$CONF" ]; then
  say "Installation failed: $CONF not found."
  exit 1
fi

sed -i -e "s|^email_alert=.*|email_alert=\"1\"|" \
       -e "s|^email_addr=.*|email_addr=\"$EMAIL\"|" \
       -e "s|^quarantine_hits=.*|quarantine_hits=\"0\"|" \
       -e "s|^scan_clamscan=.*|scan_clamscan=\"1\"|" "$CONF"

# cPanel keeps ClamAV in its own folder; link it so LMD can find it
if [ -x /usr/local/cpanel/3rdparty/bin/clamscan ]; then
  for B in clamscan clamdscan freshclam; do
    [ -e "/usr/local/bin/$B" ] || ln -s "/usr/local/cpanel/3rdparty/bin/$B" "/usr/local/bin/$B"
  done
fi

maldet -u || true

rm -rf "$WORK"
say ""
say "Done. LMD scans recently changed files every day from its cron job and emails $EMAIL."
say "Scan now with: maldet -a /home/?/public_html"
say "It is in report-only mode. Review reports with: maldet --report list"

Option 2: install step by step

1. Download and install

cd /usr/local/src
curl -fsSLO https://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzf maldetect-current.tar.gz
cd maldetect-*/
./install.sh

The folder name includes the version number, which is why the command uses maldetect-*. The installer puts LMD in /usr/local/maldetect, adds the maldet command and a daily cron job.

2. Configure alerts and behaviour

Edit /usr/local/maldetect/conf.maldet and set at least these options:

email_alert="1"
email_addr="you@example.com"
quarantine_hits="0"     # 0 = report only; 1 = quarantine automatically
scan_clamscan="1"       # use ClamAV's engine when it is installed

The default for quarantine_hits differs between versions, so check it. Start with report-only mode, review a few reports, then turn on quarantine if the results look right.

3. Link cPanel’s ClamAV (cPanel servers only)

cPanel installs ClamAV in its own folder. If LMD does not find it, add links:

ln -s /usr/local/cpanel/3rdparty/bin/clamscan /usr/local/bin/clamscan
ln -s /usr/local/cpanel/3rdparty/bin/clamdscan /usr/local/bin/clamdscan
ln -s /usr/local/cpanel/3rdparty/bin/freshclam /usr/local/bin/freshclam

4. Update the signatures

maldet -u     # update malware signatures
maldet -d     # check for a newer version of LMD

Scan for malware

# Scan every website on a cPanel server (? matches each account)
maldet -a /home/?/public_html

# Scan only files changed in the last 7 days (much faster)
maldet -r /home/?/public_html 7

# Scan one account
maldet -a /home/USER

Large scans can take a long time. Run them outside busy hours, or start with the recent-files scan.

Read the reports

maldet --report list        # list all scans
maldet --report SCANID      # show one scan, with each file and signature

Each hit shows the file path and the signature that matched. Look at the file before you act: a name such as {HEX}php.cmdshell on an unknown file in an uploads folder is almost always real.

Quarantine, restore and clean

Quarantine moves files out of reach and removes their permissions. A site may break if a needed file was infected, so have a clean copy or backup ready. Cleaning only works for some types of injected code. For a hacked CMS, replacing core files with fresh copies is more reliable.

After an infection

1. Update the CMS, themes and plugins, and remove any you do not use.
2. Change the passwords for the cPanel account, FTP, email and the CMS admin users.
3. Look for the way in: an outdated plugin is the most common cause.
4. Scan again, and keep daily backups. See our cPanel security tips.

Troubleshooting