There are couple of easy steps we need to follow to clear malware from your website.
And here I’m going to describe those steps.
Here I'll explain how to install and configure Linux Malware Detect (aka MalDet or LMD for short)
You just need to follow these steps. If you found any difficulties , you can post in the below comment box. I’ll surely help you regarding your post.
So let’s begin.
Step 1:
First of please go to this directory using below command
root@server[~]#cd /usr/local/src/
Now please download the jar using below command
root@server[~]#wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
Once you download the jar, please extract it using below command
root@server[~]#tar -xzf maldetect-current.tar.gz
After extract you need to go the maldet folder using below command
root@server[~]#cd maldetect-*
Now, run the below command to install maldet.
sh ./install.sh or sudo sh ./install.sh
It will give below output
Linux Malware Detect v1.3.4
(C) 1999-2010, R-fx Networks
(C) 2010, Ryan MacDonald
inotifywait (C) 2007, Rohan McGovern
This program may be freely redistributed under the terms of the GNU GPL
installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
cron.daily: /etc/cron.daily/maldet
maldet(32517): {sigup} performing signature update check…
maldet(32517): {sigup} local signature set is version 2010051510029
maldet(32517): {sigup} latest signature set already installed
Step 2: Configuring LMD
By default all options are fully commented in the configuration file, so configure it according to your needs. But before making any changes let’s have a detailed review of each option below.
email_alert : If you would like to receive email alerts, then it should be set to 1.
email_subj : Set your email subject here.
email_addr : Add your email address to receive malware alerts.
quar_hits : The default quarantine action for malware hits, it should be set 1.
quar_clean : Cleaning detected malware injections, must set to 1.
quar_susp : The default suspend action for users wih hits, set it as per your requirements.
quar_susp_minuid : Minimum userid that can be suspended.
Open file /usr/local/maldetect/conf.maldet and make changes according to your needs
nano /usr/local/maldetect/conf.maldet
To update the maldet use the below commands.
maldet -u or maldet -d
To scan the files. perticular user
maldet -a /home/username/
It will scan all the files and provide you the output.
To scan all user under public_html paths under /home*/ this can be done with:
root@server[~]# maldet --scan-all /home?/?/public_html
root@server[~]-maldet --scan-all /home
To scan the same path but the content that has been created/modified in the last 5 days:
root@server[~]# maldet --scan-recent /home?/?/public_html 5
To scan but forget to turn on the quarantine option, you could quarantine all malware results from a previous scan with:
root@server[~]# maldet --quarantine SCANID
If you wanted to attempt a clean on all malware results from a previous scan that did not have the feature enabled, you would do with.
root@server[~]# maldet --clean SCANID
If you had a file that was quarantined from a false positive or that you simply want to restore (i.e: you manually cleaned it), you can use the following:
root@server[~]# maldet --restore config.php.2384
root@server[~]# maldet --restore /usr/local/maldetect/quarantine/config.php.2384
Comments