{"id":71,"date":"2012-02-20T03:58:00","date_gmt":"2012-02-20T03:58:00","guid":{"rendered":"http:\/\/pheonixsolutions.com\/?p=71"},"modified":"2026-07-14T14:50:59","modified_gmt":"2026-07-14T09:20:59","slug":"maldet-scanner-for-cpanel","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/maldet-scanner-for-cpanel\/","title":{"rendered":"Malware Detect (Maldet) Scanner for cPanel"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Linux Malware Detect (Maldet or LMD) is an open-source malware scanner designed for Linux servers, especially web hosting environments such as cPanel\/WHM. It helps administrators detect malicious files, web shells, backdoors, and other malware that may exist in users&#8217; websites.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Maldet can scan specific directories, identify infected files, quarantine malicious content, and attempt to clean supported malware automatically. It also integrates well with cPanel environments and can send email notifications after scans.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Prerequisites<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Before installing Maldet, ensure that:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You have root or sudo access to the server.<\/li>\n\n\n\n<li>The server is running a Linux distribution supported by cPanel.<\/li>\n\n\n\n<li>Internet connectivity is available to download the installation package.<\/li>\n\n\n\n<li>cPanel\/WHM is installed (recommended for full integration).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Installation Steps<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Download the latest Maldet package<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">wget http:\/\/www.rfxn.com\/downloads\/maldetect-current.tar.gz\n<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Extract the downloaded archive<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">tar -xzvf maldetect-current.tar.gz\n<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Navigate to the extracted directory<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">cd maldetect-*\n<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Run the installation script<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sh install.sh\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After a successful installation, Maldet installs the following important files:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>File<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td><code>\/usr\/local\/maldetect\/conf.maldet<\/code><\/td><td>Main configuration file<\/td><\/tr><tr><td><code>\/usr\/local\/maldetect\/maldet<\/code><\/td><td>Maldet executable<\/td><\/tr><tr><td><code>\/usr\/local\/sbin\/maldet<\/code><\/td><td>Command-line shortcut<\/td><\/tr><tr><td><code>\/usr\/local\/sbin\/lmd<\/code><\/td><td>Alternative command<\/td><\/tr><tr><td><code>\/etc\/cron.daily\/maldet<\/code><\/td><td>Daily scheduled scan script<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Important Configuration Options<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The primary configuration file is located at:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/usr\/local\/maldetect\/conf.maldet\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Some commonly used configuration options include:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">email_alert<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Enables or disables email notifications after scans.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">email_addr<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifies one or more email addresses that receive scan reports.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">quar_hits<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Moves detected malware into quarantine and removes its permissions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">quar_clean<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Attempts to automatically clean supported malware signatures before restoring the files.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">quar_susp<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Suspends the cPanel account if malware is detected under that user account.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">quar_susp_minuid<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Defines the minimum user ID that is eligible for automatic suspension.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Manual Scan Examples<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Scan all cPanel public_html directories<\/h2>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">maldet --scan-all \/home?\/?\/public_html\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Scan files modified within the last 5 days<\/h2>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">maldet --scan-recent \/home?\/?\/public_html 5\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Quarantine malware from a previous scan<\/h2>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">maldet --quarantine SCANID\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace <code>SCANID<\/code> with the scan ID generated after the malware scan.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Clean malware from a previous scan<\/h2>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">maldet --clean SCANID\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace <code>SCANID<\/code> with the appropriate scan ID.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Conclusion<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Linux Malware Detect (Maldet) is a simple and effective malware scanning solution for cPanel servers. It provides malware detection, quarantine, and cleaning capabilities while integrating seamlessly with cPanel user accounts. By configuring email alerts and running regular scans, administrators can proactively identify and mitigate malware infections, helping maintain the security and integrity of hosted websites.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Linux Malware Detect (Maldet or LMD) is an open-source malware scanner designed for Linux servers, especially web hosting environments [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1019],"tags":[],"class_list":["post-71","post","type-post","status-publish","format-standard","hentry","category-cloud-aws","psol-cat-cloud-aws"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-19","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/71","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=71"}],"version-history":[{"count":2,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/71\/revisions"}],"predecessor-version":[{"id":10523,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/71\/revisions\/10523"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=71"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=71"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=71"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}