Detect and Remove Malware Using ClamAV

1. Install ClamAV (Antivirus for Linux):

   sudo apt install clamav -y   # Debian/Ubuntu
   sudo yum install clamav -y   # CentOS/RHEL

2. Update the ClamAV virus database:

   sudo freshclam
   

   (Ensures the latest virus definitions are downloaded.)

3. Run a full system scan:

   sudo clamscan -r /
   

   (Scans the entire system recursively.)

4. Scan a specific directory:

   sudo clamscan -r /home
   

   (Scans only the /home directory.)

5. Automatically remove infected files:

   sudo clamscan -r --remove /home
   

   (Use with caution to avoid deleting critical files.)

Additional Malware Protection Measures

✅ Use RKHunter to Detect Rootkits

• Install:

  sudo apt install rkhunter -y
  

• Update database:

  sudo rkhunter --update
  

• Run a scan:

  sudo rkhunter --check --sk
  

(Detects rootkits and suspicious system modifications.)

✅ Use Malware Scanners for Web Servers (e.g., Linux Servers Running Websites)

• Maldet (Linux Malware Detect)

  sudo apt install maldet -y
  sudo maldet --update
  sudo maldet --scan-all /var/www

(Scans and detects malware in website files.)

✅ Monitor and Prevent Cryptojacking Attacks

• Check for unusual CPU usage:

  top
  

• Block cryptojacking scripts with a browser extension if using a GUI.

• Use ps to find unauthorized mining processes:

  ps aux | grep -i crypto
  

Best Practices for Malware Prevention

🔹 Regularly scan your system with ClamAV and RKHunter.
🔹 Keep your OS and applications updated to patch vulnerabilities.
🔹 Avoid running untrusted scripts and use digital signatures for software verification.
🔹 Use firewall rules (ufw or iptables) to block unwanted traffic.
🔹 Monitor logs (/var/log/syslog, /var/log/auth.log) for unusual activity.

By implementing regular malware scans and proactive security measures, you reduce the risk of infections and ensure your Linux server remains clean and secure.

Multi-Factor Authentication (MFA) strengthens server security by requiring a second form of verification in addition to a password. Even if an attacker steals or guesses your password, they cannot log in without the MFA code, significantly reducing the risk of unauthorized access.

By enabling MFA, you add an extra layer of security to protect against brute-force attacks, stolen credentials, and phishing attempts.