Linux Malware Detect (Maldet or LMD) is an open-source malware scanner designed for Linux servers, especially web hosting environments such as cPanel\/WHM. It helps administrators detect malicious files, web shells, backdoors, and other malware that may exist in users’ websites.<\/p>\n\n\n\n
Maldet can scan specific directories, identify infected files, quarantine malicious content, and attempt to clean supported malware automatically. It also integrates well with cPanel environments and can send email notifications after scans.<\/p>\n\n\n\n
Before installing Maldet, ensure that:<\/p>\n\n\n\n
wget http:\/\/www.rfxn.com\/downloads\/maldetect-current.tar.gz\n<\/pre>\n\n\n\nStep 2: Extract the downloaded archive<\/h3>\n\n\n\n
tar -xzvf maldetect-current.tar.gz\n<\/pre>\n\n\n\nStep 3: Navigate to the extracted directory<\/h3>\n\n\n\n
cd maldetect-*\n<\/pre>\n\n\n\nStep 4: Run the installation script<\/h3>\n\n\n\n
sh install.sh\n<\/pre>\n\n\n\nAfter a successful installation, Maldet installs the following important files:<\/p>\n\n\n\n
File<\/th> Description<\/th><\/tr><\/thead> \/usr\/local\/maldetect\/conf.maldet<\/code><\/td>Main configuration file<\/td><\/tr> \/usr\/local\/maldetect\/maldet<\/code><\/td>Maldet executable<\/td><\/tr> \/usr\/local\/sbin\/maldet<\/code><\/td>Command-line shortcut<\/td><\/tr> \/usr\/local\/sbin\/lmd<\/code><\/td>Alternative command<\/td><\/tr> \/etc\/cron.daily\/maldet<\/code><\/td>Daily scheduled scan script<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\nImportant Configuration Options<\/h1>\n\n\n\n
The primary configuration file is located at:<\/p>\n\n\n\n
\/usr\/local\/maldetect\/conf.maldet\n<\/pre>\n\n\n\nSome commonly used configuration options include:<\/p>\n\n\n\n
email_alert<\/h3>\n\n\n\n
Enables or disables email notifications after scans.<\/p>\n\n\n\n
email_addr<\/h3>\n\n\n\n
Specifies one or more email addresses that receive scan reports.<\/p>\n\n\n\n
quar_hits<\/h3>\n\n\n\n
Moves detected malware into quarantine and removes its permissions.<\/p>\n\n\n\n
quar_clean<\/h3>\n\n\n\n
Attempts to automatically clean supported malware signatures before restoring the files.<\/p>\n\n\n\n
quar_susp<\/h3>\n\n\n\n
Suspends the cPanel account if malware is detected under that user account.<\/p>\n\n\n\n
quar_susp_minuid<\/h3>\n\n\n\n
Defines the minimum user ID that is eligible for automatic suspension.<\/p>\n\n\n\n
\n\n\n\nManual Scan Examples<\/h1>\n\n\n\n
Scan all cPanel public_html directories<\/h2>\n\n\n\n
maldet --scan-all \/home?\/?\/public_html\n<\/pre>\n\n\n\n
\n\n\n\nScan files modified within the last 5 days<\/h2>\n\n\n\n
maldet --scan-recent \/home?\/?\/public_html 5\n<\/pre>\n\n\n\n
\n\n\n\nQuarantine malware from a previous scan<\/h2>\n\n\n\n
maldet --quarantine SCANID\n<\/pre>\n\n\n\n