Set Up ClamAV & rkhunter on Your VPS to Catch Malware Early

If you're on shared wordpress-missing-a-temporary-folder-upload-error" class="auto-link">cPanel hosting, malware scanning is baked in — ImunifyAV quietly checks your files in the background. On a bare VPS, there's no such thing running unless you set it up yourself. A lot of customers only realize this after the fact: a support ticket about outbound spam, a hosting provider's abuse notice, or a site that's suddenly serving redirect scripts nobody uploaded. This guide walks through installing ClamAV (a file-level malware scanner) and rkhunter (a rootkit/backdoor checker) on your VPS, automating them, and reading the output without panicking over every warning.

Symptom

A few common ways this surfaces:

• Your hosting provider emails you about outbound spam or port-scanning traffic from your VPS IP.
• Google Safe Browsing or a client's antivirus flags your site as "deceptive" or "malware."
• You notice a PHP file, cron entry, or SSH key you don't remember creating.
• Server load is oddly high with no obvious process to explain it — sometimes a sign of a cryptominer or spam relay.

None of these prove infection on their own, but they're all reasons to actually scan instead of guessing.

Cause

A raw VPS gives you root, a firewall you configure yourself, and nothing else. Unlike a cPanel account where ImunifyAV or ImunifyAV+ scans files automatically, a self-managed VPS has zero built-in malware detection. If a WordPress plugin gets exploited, a weak SSH password gets guessed, or an old CMS on the box has a known vulnerability, nothing on the server itself will notice — the first sign is usually an external one, like the ones above. By the time you find out, the malicious code could've been sitting there for weeks.

Fix: Install ClamAV

ClamAV catches known malware signatures in files — PHP webshells, malicious uploads, infected email attachments passing through your mail server. Install it based on your distro:

AlmaLinux / Rocky Linux / CentOS:

sudo dnf install epel-release -y
sudo dnf install clamav clamav-update -y
sudo freshclam

Ubuntu / Debian:

sudo apt update
sudo apt install clamav clamav-daemon -y
sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam

The freshclam command pulls the latest virus definitions — always run it before your first scan, since a stale definitions database is close to useless.

Run Your First Scan

Scan your web root first, since that's where most real-world infections land:

sudo clamscan -r -i /var/www --log=/var/log/clamav/scan-report.log

The -i flag shows only infected files (skip the noise), -r makes it recursive. For a full-system pass — useful the first time, since rootkits and backdoors don't always live under your web root:

sudo clamscan -r -i --exclude-dir="^/sys" --exclude-dir="^/proc" /

This can take a while on a VPS with a large disk. Run it during off-peak hours the first time, since it's disk-I/O heavy.

Automate Scanning With Cron

A one-time scan tells you about today. A cron job tells you about next week too. Add a daily scan with email alerts:

sudo crontab -e

# Update definitions daily at 2am, scan web root at 3am, email if anything's found
0 2 * * * /usr/bin/freshclam --quiet
0 3 * * * /usr/bin/clamscan -r -i /var/www | mail -s "ClamAV Scan Report - $(hostname)" you@example.com

If you don't have mail configured, pipe the output to a log file instead and check it with a quick grep FOUND /var/log/clamscan.log whenever you log in — just don't let it sit unread for months.

Install rkhunter for Rootkit Detection

ClamAV is signature-based and file-focused. rkhunter looks for something different: rootkits, backdoors, suspicious SUID binaries, hidden processes, and changes to system files that shouldn't change. It's the tool that catches the stuff ClamAV was never designed to see.

# AlmaLinux/Rocky
sudo dnf install rkhunter -y

# Ubuntu/Debian
sudo apt install rkhunter -y

Before your first real scan, build a baseline of your current file properties — this is what future scans compare against:

sudo rkhunter --propupd
sudo rkhunter --update
sudo rkhunter --check

Run --check without --sk (skip-keypress) the first time so you can read each section as it goes. Once you're comfortable with what a clean report looks like, automate it:

0 4 * * * /usr/bin/rkhunter --check --skip-keypress --report-warnings-only | mail -s "rkhunter report - $(hostname)" you@example.com

Reading the Results Without Panicking

This is where most people either ignore real infections or lose a weekend chasing ghosts. A few rules of thumb:

If ClamAV flags something in your actual site files, don't just delete it — check the file's modification date against your deploy history, look for other files changed around the same time (find /var/www -newer /path/to/flagged/file is a fast way to do that), and rotate any credentials that lived on the box before you call it fixed.

Prevention

• Keep freshclam running on its own schedule — ClamAV with week-old definitions misses everything current.
• Pair this with basic hardening you've probably already done: SSH key auth only, fail2ban, and a firewall that only opens ports you actually use.
• If you're running WordPress or another CMS on the VPS, keep it and its plugins patched — scanning catches infections after the fact, it doesn't stop the exploit that got you infected in the first place.
• Don't treat a clean scan as a permanent guarantee. Schedule it, don't just run it once and forget it exists.
• If you're also running cPanel accounts on the same box, ImunifyAV handles the account-level scanning — ClamAV and rkhunter cover the parts of the OS that ImunifyAV doesn't touch.

Frequently Asked Questions

Will ClamAV slow down my VPS?

A full-system scan is disk-I/O heavy while it's running, but it's not something that sits in the background eating CPU otherwise. Schedule the heavy scans for off-peak hours (2–4am is typical) and you likely won't notice it.

Do I need both ClamAV and rkhunter, or just one?

Both — they check different things. ClamAV matches known malware signatures inside files. rkhunter looks at system-level behavior: hidden processes, altered binaries, rootkit fingerprints. A rootkit can hide from ClamAV entirely since it's not a "file" in the traditional sense that gets scanned; that's rkhunter's job.

ClamAV found something in a random cache or temp file — do I need to worry?

Check the exact path first. Browser cache directories, mail spool files, and package manager caches sometimes flag on old EICAR test signatures or benign patterns — that's a false positive most of the time. A hit inside your actual public_html, wp-content, or a cron script is the one that needs real investigation.

My VPS came with cPanel — do I still need this?

cPanel accounts get ImunifyAV automatically, which covers the hosting account layer. ClamAV and rkhunter installed directly on the VPS additionally cover the operating system itself — SSH, cron, system binaries, mail queues — areas ImunifyAV doesn't reach. Running both isn't redundant; they cover different layers.

How do I know if a warning means I'm actually compromised?

Look for corroborating evidence: an unexpected outbound connection in netstat, a cron entry you didn't create, a file with a recent modification time you can't account for, or a process using CPU/network that has no legitimate reason to. One isolated warning from either tool, with nothing else backing it up, is usually noise. Multiple signals pointing the same direction is when you stop and investigate properly — or open a ticket with your host.