Tutorials How to scan CentOS server for malware

How to scan CentOS server for malware

Some unexpected behaviour on a Linux server could be a result of malware infection, while other malicious software might not alert to their presence. Scanning your system for different types of unwanted programs can help identify issues, or at least give you the peace of mind for having a clean server.

There are multiple options for making sure your cloud server is clean of any malware, this guide goes over a couple of scanning software you can utilise for checking your system.

ClamAV

ClamAV is a popular open source antivirus engine available on a multitude of platforms including the majority of Linux distributions. Install it on CentOS 7 with the following command.

sudo yum install clamav clamav-update clamav-scanner-systemd clamav-server-systemd

Afterwards, you’ll need to edit the configuration a little by commenting out the Example text from two files, the simplest way to do so is to use sed for some fast editing with these commands.

sudo sed -i -e "s/^Example/#Example/" /etc/freshclam.conf
sudo sed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf

With the required modules installed and configured, next, you should update the virus database for ClamAV by running the updater application.

sudo freshclam

When you’ve finished updating the virus definitions, do a test scan to your home directory just to make sure the scanning works as it should use the following command.

sudo clamscan -r /home

Granted that your home directory didn’t contain any viruses or other types of malware, the scan should come back empty.

So how do you know it works?

For this, you can download an anti-virus test file, which is a small completely harmless program that most anti-virus software report as infected, though with an obvious test file name EICAR-AV-Test. Use the following command to download the test file to your home directory.

wget -P ~/ http://www.eicar.org/download/eicar.com

Now scan your home folder again with the same command as above, you should receive notice of one infected file at the end summary after the scan is completed. When you’ve confirmed that ClamAV finds the test file correctly, use the command below to scan it again and remove the infected file once found.

sudo clamscan --infected --remove --recursive /home

Be careful when using the –remove parameter. First, run a broader scan without it, and then more localized scan when removing files or remove them manually.

To perform a complete scan of your cloud server, use the this command.

sudo clamscan --infected --recursive --exclude-dir="^/sys" /

The scan goes through each directory in your system root recursively, but skips /sys just to avoid unnecessary warning printouts, as the virtual file system consists of some unreadable files, which could not contain viruses anyway.

Rkhunter

Rkhunter is a common option for scanning your system for rootkits and general vulnerabilities. It can be easily installed from the package manager on CentOS using the following command.

sudo yum install rkhunter

Once installed and before scanning, you’ll need to update the file properties database.

sudo rkhunter --propupd

This lets the scanner to know the current state of certain files to prevent some false alarms. After the update, simply run the scanner with the following.

sudo rkhunter --checkall

The scanner goes through some system commands, checks for actual rootkits and some malware, network and local host settings, and then gives you the summary as well as recording the findings to a log file.

Afterwards, you can get a condensed look at the scan log with this command.

sudo cat /var/log/rkhunter/rkhunter.log | grep -i warning

Go through the output to get some tips on what you could do to improve your system security.

Leave a Reply

Your email address will not be published. Required fields are marked *

Locations

Helsinki (HQ)

In the capital city of Finland, you will find our headquarters, and our first data centre. This is where we handle most of our development and innovation.

London

London was our second office to open, and a important step in introducing UpCloud to the world. Here our amazing staff can help you with both sales and support, in addition to host tons of interesting meetups.

Seattle

Seattle is our 4th and latest office to be opened, and our way to reach out across the pond to our many users in the Americas.

Singapore

Singapore was our 3rd office to be opened, and enjoys one of most engaged and fastest growing user bases we have ever seen.