{"id":3550,"date":"2016-02-27T23:07:55","date_gmt":"2016-02-28T04:07:55","guid":{"rendered":"http:\/\/underhost.com\/blog\/?p=3550"},"modified":"2026-10-23T08:55:52","modified_gmt":"2026-10-23T12:55:52","slug":"how-to-install-linux-malware-detect","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/how-to-install-linux-malware-detect\/","title":{"rendered":"How to Install and Use Linux Malware Detect (LMD, maldet) on Linux and cPanel (2026)"},"content":{"rendered":"<div class=\"uh-blog-hero\" style=\"margin:0 0 40px;text-align:center;padding:48px 24px;border-radius:20px;background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;box-shadow:0 20px 40px -15px rgba(13,31,60,0.28);position:relative;overflow:hidden;\">\n<div style=\"display:inline-flex;align-items:center;gap:8px;padding:7px 14px;margin-bottom:16px;border:1px solid rgba(0,212,255,0.32);border-radius:999px;color:#DFF8FF;font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;background:rgba(0,212,255,0.10);\"><i class=\"fas fa-cogs\" style=\"color:#00D4FF;\"><\/i> cPanel &amp; WHM<\/div>\n<h1 style=\"color:#ffffff;font-size:clamp(32px,5vw,46px);line-height:1.12;margin:0 0 14px;font-weight:800;\">How to Install and Use Linux Malware Detect (LMD, maldet) on Linux and cPanel (2026)<\/h1>\n<\/div>\n<div class=\"uh-blog-excerpt\" style=\"border-left:4px solid #00D4FF;padding:18px 20px;margin:0 0 34px;background:#F8FAFC;color:#1F2937;border-radius:0 14px 14px 0;box-shadow:0 8px 28px rgba(13,31,60,0.08);line-height:1.75;\"><strong style=\"color:#0D1F3C;\">Short answer:<\/strong> Download LMD from R-fx Networks, extract it and run <code>.\/install.sh<\/code> as root. Set your email address in <code>\/usr\/local\/maldetect\/conf.maldet<\/code>, update the signatures with <code>maldet -u<\/code>, then scan every website with <code>maldet -a \/home\/?\/public_html<\/code>. LMD installs a daily cron job that scans recently changed files. Install ClamAV as well, so LMD can use its faster scan engine, and review reports before you quarantine or clean anything.<\/div>\n<nav aria-label=\"Table of contents\" class=\"uh-toc\" style=\"background:#ffffff;border:1px solid #E5E7EB;border-radius:16px;padding:20px 22px;margin:0 0 34px;box-shadow:0 4px 12px rgba(13,31,60,0.08);\">\n<div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#176EA5;margin-bottom:10px;\"><i class=\"fas fa-list\" style=\"color:#00D4FF;\"><\/i> In this guide<\/div>\n<ol style=\"margin:0;padding-left:20px;columns:2 260px;column-gap:28px;line-height:1.9;\">\n<li><a href=\"#what-linux-malware-detect-does\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">What Linux Malware Detect does<\/a><\/li>\n<li><a href=\"#before-you-start\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Before you start<\/a><\/li>\n<li><a href=\"#option-1-the-one-command-helper\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 1: the one-command helper<\/a><\/li>\n<li><a href=\"#option-2-install-step-by-step\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 2: install step by step<\/a><\/li>\n<li><a href=\"#scan-for-malware\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Scan for malware<\/a><\/li>\n<li><a href=\"#read-the-reports\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Read the reports<\/a><\/li>\n<li><a href=\"#quarantine-restore-and-clean\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Quarantine, restore and clean<\/a><\/li>\n<li><a href=\"#after-an-infection\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">After an infection<\/a><\/li>\n<li><a href=\"#troubleshooting\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Troubleshooting<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"uh-post-content\" style=\"color:#1F2937;font-size:16px;line-height:1.75;\">\n<h2 id=\"what-linux-malware-detect-does\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-shield-alt\" style=\"color:#00D4FF;\"><\/i> What Linux Malware Detect does<\/h2>\n<p style=\"margin:0 0 18px;\">Linux Malware Detect, also called LMD or maldet, is a free malware scanner from R-fx Networks. It is written for shared hosting servers, so its signatures focus on the threats found in websites: PHP web shells, backdoors, mailers, defacement scripts and injected code. It can:<\/p>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Scan folders on demand, or only files changed in the last few days.<\/li>\n<li style=\"margin:0 0 8px;\">Run a daily scan from cron and email you the results.<\/li>\n<li style=\"margin:0 0 8px;\">Quarantine infected files, or try to clean some types of injected code.<\/li>\n<li style=\"margin:0 0 8px;\">Use ClamAV&#8217;s scan engine for faster scans, when ClamAV is installed.<\/li>\n<li style=\"margin:0 0 8px;\">Watch folders in real time with inotify, if you turn on monitoring mode.<\/li>\n<\/ul>\n<p style=\"margin:0 0 18px;\">LMD complements other tools. <a href=\"https:\/\/underhost.com\/blog\/how-to-install-clamav-cpanel\/\">ClamAV<\/a> covers email and general malware, and <a href=\"https:\/\/underhost.com\/blog\/how-to-install-rkhunter-on-linux-rootkit-hunter\/\">rkhunter<\/a> checks the system itself for rootkits.<\/p>\n<h2 id=\"before-you-start\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-clipboard-check\" style=\"color:#00D4FF;\"><\/i> Before you start<\/h2>\n<ul style=\"list-style:none;padding-left:0;\">\n<li style=\"margin:0 0 8px;\">\u2713 Root access to a VPS or dedicated server. LMD cannot be installed on a shared hosting account.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 A recent backup of the websites, in case you need to restore a cleaned file.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 ClamAV installed, ideally. On cPanel, install it from WHM first.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 A working mail setup, if you want email alerts.<\/li>\n<\/ul>\n<h2 id=\"option-1-the-one-command-helper\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Option 1: the one-command helper<\/h2>\n<p style=\"margin:0 0 18px;\">The helper script downloads and installs LMD, sets your alert email, keeps it in report-only mode, links cPanel&#8217;s ClamAV if it is installed, and updates the signatures. Report-only mode means nothing is moved until you decide.<\/p>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Save the script below as <code>lmd-setup.sh<\/code> on the server, for example in <code>\/root<\/code>.<\/li>\n<li style=\"margin:0 0 8px;\">Check the current status. This changes nothing:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo bash lmd-setup.sh check<\/code><\/pre>\n<ol start=\"3\" style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Install LMD with your email address. The script asks you to type YES first:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo bash lmd-setup.sh install you@example.com<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">The helper script<\/h3>\n<p style=\"margin:0 0 18px;\">Read the script before you run it. It downloads only the LMD archive from R-fx Networks.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>#!\/usr\/bin\/env bash\n# lmd-setup.sh\n# Installs Linux Malware Detect (LMD, maldet) from R-fx Networks, sets the alert email,\n# keeps it in report-only mode, links cPanel's ClamAV if present, and updates the signatures.\n#\n# Usage (run as root):\n#   sudo bash lmd-setup.sh check                     report status. Changes nothing. Default.\n#   sudo bash lmd-setup.sh install you@example.com   install and set up. Asks for confirmation.\n\nset -u\n\nMODE=\"${1:-check}\"\nEMAIL=\"${2:-root}\"\nURL=\"https:\/\/www.rfxn.com\/downloads\/maldetect-current.tar.gz\"\nCONF=\/usr\/local\/maldetect\/conf.maldet\n\nsay()  { printf '%s\\n' \"$*\"; }\nhave() { command -v \"$1\" &gt;\/dev\/null 2&gt;&amp;1; }\n\nif [ \"$(id -u)\" -ne 0 ]; then\n  say \"Run this script as root (sudo bash lmd-setup.sh $MODE).\"\n  exit 1\nfi\n\nsay \"== Status ==\"\nif have maldet; then\n  maldet --help 2&gt;\/dev\/null | head -n 2\n  [ -f \"$CONF\" ] &amp;&amp; grep -E '^(email_alert|email_addr|quarantine_hits|scan_clamscan)=' \"$CONF\"\nelse\n  say \"LMD (maldet) is not installed.\"\nfi\nif [ -x \/usr\/local\/cpanel\/3rdparty\/bin\/clamscan ] || have clamscan; then\n  say \"ClamAV: found (LMD will use its scan engine).\"\nelse\n  say \"ClamAV: not found (LMD will use its own, slower engine).\"\nfi\n\n[ \"$MODE\" = \"check\" ] &amp;&amp; exit 0\nif [ \"$MODE\" != \"install\" ]; then\n  say \"Unknown mode: $MODE. Use check or install.\"\n  exit 1\nfi\n\nsay \"\"\nsay \"This will download LMD from $URL, install it in \/usr\/local\/maldetect,\"\nsay \"send alerts to $EMAIL, keep it in report-only mode (no automatic quarantine)\"\nsay \"and update its signatures.\"\nprintf 'Type YES to continue: '\nread -r ANSWER\nif [ \"$ANSWER\" != \"YES\" ]; then\n  say \"Stopped. Nothing was changed.\"\n  exit 0\nfi\n\nWORK=\"$(mktemp -d)\"\ncd \"$WORK\" || exit 1\nif ! curl -fsSL -o maldetect-current.tar.gz \"$URL\"; then\n  say \"Download failed. Nothing was installed.\"\n  exit 1\nfi\ntar -xzf maldetect-current.tar.gz\ncd maldetect-*\/ || { say \"Unexpected archive layout. Nothing was installed.\"; exit 1; }\n.\/install.sh\n\nif [ ! -f \"$CONF\" ]; then\n  say \"Installation failed: $CONF not found.\"\n  exit 1\nfi\n\nsed -i -e \"s|^email_alert=.*|email_alert=\\\"1\\\"|\" \\\n       -e \"s|^email_addr=.*|email_addr=\\\"$EMAIL\\\"|\" \\\n       -e \"s|^quarantine_hits=.*|quarantine_hits=\\\"0\\\"|\" \\\n       -e \"s|^scan_clamscan=.*|scan_clamscan=\\\"1\\\"|\" \"$CONF\"\n\n# cPanel keeps ClamAV in its own folder; link it so LMD can find it\nif [ -x \/usr\/local\/cpanel\/3rdparty\/bin\/clamscan ]; then\n  for B in clamscan clamdscan freshclam; do\n    [ -e \"\/usr\/local\/bin\/$B\" ] || ln -s \"\/usr\/local\/cpanel\/3rdparty\/bin\/$B\" \"\/usr\/local\/bin\/$B\"\n  done\nfi\n\nmaldet -u || true\n\nrm -rf \"$WORK\"\nsay \"\"\nsay \"Done. LMD scans recently changed files every day from its cron job and emails $EMAIL.\"\nsay \"Scan now with: maldet -a \/home\/?\/public_html\"\nsay \"It is in report-only mode. Review reports with: maldet --report list\"<\/code><\/pre>\n<h2 id=\"option-2-install-step-by-step\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Option 2: install step by step<\/h2>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">1. Download and install<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>cd \/usr\/local\/src\ncurl -fsSLO https:\/\/www.rfxn.com\/downloads\/maldetect-current.tar.gz\ntar -xzf maldetect-current.tar.gz\ncd maldetect-*\/\n.\/install.sh<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">The folder name includes the version number, which is why the command uses <code>maldetect-*<\/code>. The installer puts LMD in <code>\/usr\/local\/maldetect<\/code>, adds the <code>maldet<\/code> command and a daily cron job.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">2. Configure alerts and behaviour<\/h3>\n<p style=\"margin:0 0 18px;\">Edit <code>\/usr\/local\/maldetect\/conf.maldet<\/code> and set at least these options:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>email_alert=\"1\"\nemail_addr=\"you@example.com\"\nquarantine_hits=\"0\"     # 0 = report only; 1 = quarantine automatically\nscan_clamscan=\"1\"       # use ClamAV's engine when it is installed<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">The default for <code>quarantine_hits<\/code> differs between versions, so check it. Start with report-only mode, review a few reports, then turn on quarantine if the results look right.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">3. Link cPanel&#8217;s ClamAV (cPanel servers only)<\/h3>\n<p style=\"margin:0 0 18px;\">cPanel installs ClamAV in its own folder. If LMD does not find it, add links:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>ln -s \/usr\/local\/cpanel\/3rdparty\/bin\/clamscan \/usr\/local\/bin\/clamscan\nln -s \/usr\/local\/cpanel\/3rdparty\/bin\/clamdscan \/usr\/local\/bin\/clamdscan\nln -s \/usr\/local\/cpanel\/3rdparty\/bin\/freshclam \/usr\/local\/bin\/freshclam<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">4. Update the signatures<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>maldet -u     # update malware signatures\nmaldet -d     # check for a newer version of LMD<\/code><\/pre>\n<h2 id=\"scan-for-malware\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-shield-alt\" style=\"color:#00D4FF;\"><\/i> Scan for malware<\/h2>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># Scan every website on a cPanel server (? matches each account)\nmaldet -a \/home\/?\/public_html\n\n# Scan only files changed in the last 7 days (much faster)\nmaldet -r \/home\/?\/public_html 7\n\n# Scan one account\nmaldet -a \/home\/USER<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Large scans can take a long time. Run them outside busy hours, or start with the recent-files scan.<\/p>\n<h2 id=\"read-the-reports\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Read the reports<\/h2>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>maldet --report list        # list all scans\nmaldet --report SCANID      # show one scan, with each file and signature<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Each hit shows the file path and the signature that matched. Look at the file before you act: a name such as <code>{HEX}php.cmdshell<\/code> on an unknown file in an uploads folder is almost always real.<\/p>\n<h2 id=\"quarantine-restore-and-clean\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-database\" style=\"color:#00D4FF;\"><\/i> Quarantine, restore and clean<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Task<\/th>\n<th style=\"padding:14px;text-align:left;\">Command<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Quarantine all hits from a scan<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>maldet -q SCANID<\/code><\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Restore a quarantined file<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>maldet -s \/usr\/local\/maldetect\/quarantine\/FILE<\/code><\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Try to clean all hits from a scan<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>maldet -n SCANID<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p style=\"margin:0 0 18px;\">Quarantine moves files out of reach and removes their permissions. A site may break if a needed file was infected, so have a clean copy or backup ready. Cleaning only works for some types of injected code. For a hacked CMS, replacing core files with fresh copies is more reliable.<\/p>\n<h2 id=\"after-an-infection\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> After an infection<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Update the CMS, themes and plugins, and remove any you do not use.<\/li>\n<li style=\"margin:0 0 8px;\">Change the passwords for the cPanel account, FTP, email and the CMS admin users.<\/li>\n<li style=\"margin:0 0 8px;\">Look for the way in: an outdated plugin is the most common cause.<\/li>\n<li style=\"margin:0 0 8px;\">Scan again, and keep daily backups. See our <a href=\"https:\/\/underhost.com\/blog\/top-cpanel-security-tips-to-keep-your-hosting-environment-safe\/\">cPanel security tips<\/a>.<\/li>\n<\/ol>\n<h2 id=\"troubleshooting\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#00D4FF;\"><\/i> Troubleshooting<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;min-width:600px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Problem<\/th>\n<th style=\"padding:14px;text-align:left;\">Likely cause<\/th>\n<th style=\"padding:14px;text-align:left;\">Fix<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Scans are very slow<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">ClamAV is not being used<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Install ClamAV, check <code>scan_clamscan=\"1\"<\/code>, and link the cPanel binaries.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">No email alerts<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">email_alert is off, or the server cannot send mail<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Check conf.maldet and test mail from the server.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">A website broke after a scan<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">A needed file was quarantined<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Restore it with <code>maldet -s<\/code>, then clean or replace it.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div aria-hidden=\"true\" class=\"uh-section-divider\" style=\"width:min(100% - 32px, 1080px);margin:44px auto;display:grid;grid-template-columns:1fr 32px 1fr;align-items:center;gap:18px;pointer-events:none;\"><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(0,212,255,0.40),rgba(23,110,165,0.24),transparent);\"><\/span><img alt=\"\" decoding=\"async\" height=\"32\" loading=\"lazy\" src=\"https:\/\/cdn.underhost.com\/android-chrome-192x192.webp\" style=\"width:32px;height:32px;display:block;border-radius:8px;filter:drop-shadow(0 0 14px rgba(0,212,255,0.30));\" width=\"32\"\/><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(23,110,165,0.24),rgba(0,212,255,0.40),transparent);\"><\/span><\/div>\n<\/div>\n<div class=\"uh-blog-cta\" style=\"background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;padding:36px 24px;border-radius:20px;text-align:center;margin:44px 0;box-shadow:0 20px 40px -15px rgba(13,31,60,0.32);\">\n<h2 style=\"margin:0 0 12px;font-size:28px;line-height:1.25;color:#ffffff;\">Need help with this?<\/h2>\n<p style=\"font-size:17px;margin:0 auto 22px;color:#EAF6FF;max-width:720px;line-height:1.7;\">Found malware on your server? Our team can clean it, find the way in, and set up scanning so it does not come back.<\/p>\n<p><a href=\"https:\/\/underhost.com\/server-management.php\" style=\"background:linear-gradient(90deg,#00D4FF,#0077FF);color:#ffffff;padding:13px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;\">See server management plans<\/a><a href=\"https:\/\/customerpanel.ca\/client\/\" style=\"background:transparent;color:#ffffff;padding:12px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;border:1px solid rgba(255,255,255,0.32);\">Contact @CustomerPanel<\/a><\/div>\n<div class=\"uh-faq-section\" id=\"faq\" style=\"margin:34px 0;scroll-margin-top:90px;\">\n<h2 style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:0 0 18px;border-bottom:2px solid rgba(0,212,255,0.22);padding-bottom:10px;\">Frequently asked questions<\/h2>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Is Linux Malware Detect free?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. LMD is free and open source, released by R-fx Networks under the GNU GPL.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Does LMD work on cPanel?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. It was written for shared hosting servers and works well on cPanel, especially together with the ClamAV plugin.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Should I turn on automatic quarantine?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Start in report-only mode. After reviewing a few reports, turn on quarantine_hits if you trust the results.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">How often does LMD scan?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">The installer adds a daily cron job that scans recently changed files. You can also run full scans at any time.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Can I run LMD on shared hosting?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">No. It needs root access. On shared hosting, your host runs the scans.<\/p>\n<\/div>\n<\/div>\n<p><!-- uh-related-start --><\/p>\n<div style=\"background:#F4F8FC;border:1px solid #DCE7F3;border-radius:14px;padding:18px 22px;margin:32px 0 8px;\">\n<h2 style=\"margin:0 0 12px;font-size:22px;\">Related guides<\/h2>\n<ul style=\"margin:0;padding-left:20px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-to-install-rkhunter-on-linux-rootkit-hunter\/\">How to Install RKHunter on Linux (RootKit Hunter) in RHEL, CentOS and Fedora<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-to-install-clamav-cpanel\/\">How to Install and Use ClamAV Antivirus in WHM\/cPanel<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/clean-malware-and-restore-your-hacked-website-with-hourly-server-management\/\">Clean Malware and Restore Your Hacked Website with Hourly Server Management<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/ghostlock-and-januscape-what-self-managed-linux-server-owners-need-to-patch-now\/\">GhostLock and Januscape: What Self-Managed Linux Server Owners Need to Patch Now<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/install-htop-2-0-better-linux-process-monitoring-for-rhel-centos-fedora\/\">How to Install and Use Htop on Linux (Step-by-Step Updated Guide)<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- uh-related-end --><br \/>\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Is Linux Malware Detect free?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. LMD is free and open source, released by R-fx Networks under the GNU GPL.\"}}, {\"@type\": \"Question\", \"name\": \"Does LMD work on cPanel?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. It was written for shared hosting servers and works well on cPanel, especially together with the ClamAV plugin.\"}}, {\"@type\": \"Question\", \"name\": \"Should I turn on automatic quarantine?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Start in report-only mode. After reviewing a few reports, turn on quarantine_hits if you trust the results.\"}}, {\"@type\": \"Question\", \"name\": \"How often does LMD scan?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"The installer adds a daily cron job that scans recently changed files. You can also run full scans at any time.\"}}, {\"@type\": \"Question\", \"name\": \"Can I run LMD on shared hosting?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. It needs root access. On shared hosting, your host runs the scans.\"}}]}<\/script><\/p>\n<h2 id=\"sources\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-book\" style=\"color:#00D4FF;\"><\/i> Sources<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/www.rfxn.com\/projects\/linux-malware-detect\/\">R-fx Networks: Linux Malware Detect<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/github.com\/rfxn\/linux-malware-detect\">Linux Malware Detect on GitHub<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/docs.cpanel.net\/whm\/plugins\/configure-clamav-scanner\/\">cPanel documentation: Configure ClamAV Scanner<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Linux Malware Detect (LMD) is an open-source malware scanner for Linux systems, specifically designed for shared hosting environments. It leverages real-time threat intelligence from network intrusion detection systems and community submissions to identify and eliminate malware. LMD integrates seamlessly with ClamAV to enhance scanning capabilities using both MD5 hash-based and HEX pattern matching detection techniques.<\/p>\n","protected":false},"author":1,"featured_media":5015,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[202,25,203],"tags":[125,108,115,127],"class_list":["post-3550","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cpanel-whm","category-linux","category-security","tag-tag-backups","tag-tag-cpanel","tag-tag-linux-server","tag-tag-malware-protection"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3550","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=3550"}],"version-history":[{"count":11,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3550\/revisions"}],"predecessor-version":[{"id":6945,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3550\/revisions\/6945"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/5015"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=3550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=3550"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=3550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}