How to install Linux Malware Detect (LMD)

Maldet also known as Linux Malware Detect virus scanner for Linux.

Go to the below path

cd /usr/local/src/

Download the tar file using the below link:

wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

Extract the file using the below command

tar -xzf maldetect-current.tar.gz

go to the maldet folder

cd maldetect-*

Now, run the below command to install maldet.

sh ./install.sh or sudo sh ./install.sh

It will give below output

Linux Malware Detect v1.3.4
(C) 1999-2010, R-fx Networks <proj@r-fx.org>
(C) 2010, Ryan MacDonald <ryan@r-fx.org>
inotifywait (C) 2007, Rohan McGovern <rohan@mcgovern.id.au>
This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
cron.daily: /etc/cron.daily/maldet

maldet(32517): {sigup} performing signature update check…
maldet(32517): {sigup} local signature set is version 2010051510029
maldet(32517): {sigup} latest signature set already installed

To update the maldet use the below commands.

maldet –update-ver

maldet –update[/i]

To scan the files.

maldet -a /home/username/

It will scan all the files and provide you the output.

To scan all user uder public_html paths under /home*/ this can be done with:

root@server[~]# maldet –scan-all /home?/?/public_html

To scan the same path but the content that has been created/modified in the last 5 days:

root@server[~]# maldet –scan-recent /home?/?/public_html 5

To scan but forget to turn on the quarantine option, you could quarantine all malware results from a previous scan with:

root@server[~]# maldet –quarantine SCANID

If you wanted to attempt a clean on all malware results from a previous scan that did not have the feature enabled, you would do with.

root@server[~]# maldet –clean SCANID

If you had a file that was quarantined from a false positive or that you simply want to restore (i.e: you manually cleaned it), you can use the following:

root@server[~]# maldet –restore config.php.2384
root@server[~]# maldet –restore /usr/local/maldetect/quarantine/config.php.2384