Linux Malware Detect (LMD) is a malware scanner. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks and generates signatures for detection
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xf maldetect-current.tar.gz
cd maldetect-*
./install.sh
You could run the scan against the / directory, but depending on how much data you have, this could take hours or days.
I generally focus on the /var/www/vhosts directory for Plesk servers and the /home directory on cPanel server but this in this example we are going to sayour website content is in /var/www
maldet -u
maldet --scan-all /var/www
If you would like to scan the entire server then you can use:
maldet --scan-all /
You can also set up maldet to email you if it find anything of note during scheduled scans. For this you need to edit the file /usr/local/maldetect/conf.maldet
email_alert=1
email_addr="[email protected]"