Skip to main content

Malware and Antivirus on Linux

While Linux is significantly less susceptible to malware than Windows due to its strict permissions model and diverse software landscape, it is not immune. Servers are often targeted by cryptominers, botnet agents, and ransomware.

ClamAV​

ClamAV is the open-source standard for antivirus scanning on Linux. It is widely used on mail servers to scan attachments, but can also be used for system scans.

Installation and Usage​

# Install ClamAV
sudo apt update && sudo apt install clamav clamav-daemon

# Update virus definitions manually (freshclam runs as a background service)
sudo freshclam

# Scan a directory recursively, ring a bell if a virus is found
clamscan -r --bell -i /home/user/Downloads

Recognizing Malware Infections​

Signs your server might be compromised:

  • Unusually high CPU usage (often indicating a cryptominer).
  • Unknown processes running, especially if they try to hide their names.
  • Outbound network traffic to suspicious IP addresses.
  • Files appearing in /tmp or /var/tmp that are executable.

Prevention is Better than Cure​

Antivirus on Linux is generally reactive. Proactive security is better:

  • Only install software from official package managers or highly trusted sources.
  • Do not run untrusted scripts downloaded from the internet blindly (curl -sL http://example.com/script.sh | bash is dangerous).
  • Keep your web applications (WordPress, plugins, etc.) updated, as these are the most common entry points for Linux server infections.