Scan a website for viruses with ClamAV

ClamAV is a free antivirus for servers. It finds known malicious files: web shells, infected scripts and emails carrying viruses. If your website has already been hacked, a scan on its own isn’t enough — the steps to follow, in order, are in My website has been hacked: what to do.

Installation

Ubuntu and Debian: sudo apt install clamav. The virus databases are updated by the clamav-freshclam service, which starts on its own.

AlmaLinux:

sudo dnf install epel-release
sudo dnf install clamav clamav-freshclam
sudo systemctl enable --now clamav-freshclam

FreeBSD:

sudo pkg install clamav
sudo sysrc clamav_freshclam_enable=YES
sudo service clamav_freshclam start

The first download of the databases takes a few minutes.

Scanning

sudo clamscan -r -i /var/www

-r scans all subfolders, and -i shows only the infected files. At the end you get a summary of how many files were scanned and how many were found. A scan loads the databases into memory, so on a server with little memory a swap file can help.

Scanning every night

Add a job to root’s cron (sudo crontab -e):

0 4 * * * /usr/bin/clamscan -r -i /var/www >> /var/log/clamscan.log 2>&1

On FreeBSD the path to the program is /usr/local/bin/clamscan. For more about scheduling, see Cron: running scripts on a schedule.