Installing and Using Maldet

Maldet is malware detection software for Linux. This free tool lets you detect malicious software on your Linux server. You can find more information about Linux Malware Detect, written by R-fx Networks, at http://www.rfxn.com/projects/linux-malware-detect/. This article covers how to install and use it.

Installation

Running the commands below is enough to install it.

wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar zxvf maldetect-current.tar.gz
cd maldetect-*
sh install.sh

One warning before moving on to usage examples: Linux Malware Detect, or maldet for short, uses a lot of disk I/O while scanning. On slow or busy disks it can cause serious performance problems on your system.

Usage

maldet --help prints all maldet parameters.

Here is an example command for scanning a website that has been hacked or infected with a backdoor. On a cPanel server, if the cPanel user of the example domain verinomi is verinomi:

maldet -a /home/verinomi/public_html

This command starts a malware scan of that site's files. When the scan starts, maldet shows you the number of files.

maldet(9174): {scan} 653/14045 files scanned: 0 hits 0 cleaned

In this example, taken while the scan was running, 653 of 14045 files have been scanned so far. Any malicious content found is shown under hits, and any content cleaned under cleaned.

When the scan finishes, maldet prints the commands for reporting and cleaning. Examples are below.

maldet(9174): {scan} scan completed on /root/: files 14045, malware hits 1, cleaned hits

The line above means that one piece of malicious content was detected.

maldet(9709): {scan} scan report saved, to view run: maldet --report 081513-2051.9709

The line above means that, to see the report, names and other details of the malicious content, you need to run maldet --report 081513-2051.9709. The number in this command is generated automatically by the system for each scan.

maldet(9709): {scan} quarantine is disabled! set quar_hits=1 in conf.maldet or to quarantine results run: maldet -q 081513-2051.9709

The line above means that, to clean, delete or quarantine all files in the report, you need to run maldet -q 081513-2051.9709.

Some further commands and settings:

maldet --report list

lists the scans you have run before.

maldet --monitor

scans continuously. For example, maldet --monitor /home keeps scanning files uploaded to /home; use maldet -k to stop it. Because it keeps running in the background, it can cause serious performance problems on slow or busy disks.

maldet -a /home/?/public_html

The question mark in this command works as a wildcard and scans the public_html folders inside every folder under /home. This way you can scan the whole server for malware faster, by scanning fewer files.

maldet -b : Runs long scans in the background, so you can start a scan and close the SSH connection. (e.g. maldet -b -a /home/)

maldet -u : Updates the maldet signature database.

maldet -r : Scans only files added or changed within a given number of days (e.g. maldet -r /home/?/public_html 2 scans files from the last 2 days.)

maldet --restore : Restores cleaned or quarantined files. If cleaning damages your software, you can restore using the scan number (e.g. maldet --restore 081513-2051.9709)

maldet -p : Deletes all quarantined files, logs and open sessions.

You can also customise maldet by editing its configuration file.

nano -w /usr/local/maldetect/conf.maldet

Running the command above opens the maldet configuration file in the nano editor. There you can set maldet to email you about the malware it finds when running in monitor mode, to quarantine it automatically, and change other scan details.

On cPanel servers, you can also set quar_susp to 1 in the configuration file so that accounts in which malware is found are suspended automatically.