Install Linux Malware Detect on Debian / Ubuntu / LinuxMint – A Malware Scanner for Linux Operating System


LMD (Linux Malware Detect) is an open source malware detector for Linux operating systems. LMD is particularly designed for shared hosting environments to detect and clear threats in users file.

In this guide, we will install Linux Malware Detect (LMD) with ClamAV on Debian 9 / Ubuntu 16.04 / LinuxMint 18.

Install Linux Malware Detect on Debian

LMD is not available on base repositories as a pre-built package, but you can get LMD as a tarball from the official project website.

Download the latest version of LMD (v1.6.2) using the following command.

cd /tmp/
curl -O

Unpack the tarball using tar command.

tar -zxvf maldetect-current.tar.gz

Go to the extracted directory.

cd maldetect-1.6.2/

Run the installation script present in the extracted directory.



Created symlink /etc/systemd/system/ → /usr/lib/systemd/system/maldet.service.
update-rc.d: error: unable to read /etc/init.d/maldet
Linux Malware Detect v1.6
            (C) 2002-2017, R-fx Networks <[email protected]>
            (C) 2017, Ryan MacDonald <[email protected]>
This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
exec link: /usr/local/sbin/lmd
cron.daily: /etc/cron.daily/maldet
maldet(933): {sigup} performing signature update check...
maldet(933): {sigup} local signature set is version 2017070716978
maldet(933): {sigup} new signature set (201708255569) available
maldet(933): {sigup} downloading
maldet(933): {sigup} downloading
maldet(933): {sigup} verified md5sum of maldet-sigpack.tgz
maldet(933): {sigup} unpacked and installed maldet-sigpack.tgz
maldet(933): {sigup} verified md5sum of maldet-clean.tgz
maldet(933): {sigup} unpacked and installed maldet-clean.tgz
maldet(933): {sigup} signature set update completed
maldet(933): {sigup} 15218 signatures (12485 MD5 | 1954 HEX | 779 YARA | 0 USER)

Configure Linux Malware Detect

/usr/local/maldetect/conf.maldet is the main configuration file of LMD. You can modify its parameters according to your requirements.

nano /usr/local/maldetect/conf.maldet

Below are the few settings you should have it on LMD for successful detection and deletion of malware threats.

# Enable Email Alerting

# Email Address in which you want to receive scan reports
email_addr="[email protected]"

# Use with ClamAV

# Enable scanning for root-owned files. Set 1 to disable.

# Move threats to quarantine

# Clean string based malware injections

# Suspend user if malware found. 

# Minimum userid value that be suspended

If you do not wish to use LMD with ClamAV, then skip the below part.

Linux Malware Detect with ClamAV

LMD performs better with ClamAV, especially when it comes to scanning large file sets. ClamAV (Clam Antivirus) is an open source antivirus engine to detect the virus, malware, trojans & other malicious threats.

ClamAV is available in the base repository, so you can use apt command to install it.

apt-get -y install clamav clamav-daemon clamdscan

By default, the use of ClamAV with LMD has been enabled.

Scan with Linux Malware Detect

Let us test the functionality of LMD by downloading sample virus signature from EICAR website.

cd /tmp

Now, scan the /tmp directory for malware.

maldet -a /tmp


Linux Malware Detect v1.6.2
            (C) 2002-2017, R-fx Networks <[email protected]>
            (C) 2017, Ryan MacDonald <[email protected]>
This program may be freely redistributed under the terms of the GNU GPL v2

maldet(4209): {scan} signatures loaded: 15218 (12485 MD5 | 1954 HEX | 779 YARA | 0 USER)
maldet(4209): {scan} building file list for /tmp, this might take awhile...
maldet(4209): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6
maldet(4209): {scan} file list completed in 0s, found 4 files...
maldet(4209): {scan} found clamav binary at /usr/bin/clamscan, using clamav scanner engine...
maldet(4209): {scan} scan of /tmp (4 files) in progress...
maldet(4209): {scan} processing scan results for hits: 2 hits 0 cleaned
maldet(4209): {scan} scan completed on /tmp: files 4, malware hits 2, cleaned hits 0, time 12s
maldet(4209): {scan} scan report saved, to view run: maldet --report 171026-1103.4209

From the output, you can notice that LMD is using ClamAV scanner engine to perform the scan and succeeded in finding two malware hits.

Linux Malware Detector Scan Report

LMD stores its scan reports under /usr/local/maldetect/sess/. Use the maldet command along with SCAN ID to see the detailed scanning report.

maldet --report 171026-1103.4209


HOST:      lmd
SCAN ID:   171026-1103.4209
STARTED:   Oct 26 2017 11:03:16 +0000
COMPLETED: Oct 26 2017 11:03:28 +0000
ELAPSED:   12s [find: 0s]

PATH:          /tmp

{HEX}EICAR.TEST.10 : /tmp/ => /usr/local/maldetect/quarantine/
{HEX}EICAR.TEST.10 : /tmp/ => /usr/local/maldetect/quarantine/
Linux Malware Detect v1.6.2 < [email protected] >

Update Linux Malware Detect

Use the below command to update your LMD.

maldet -d

To update LMD signatures, run:

maldet -u

That’s All.


You might also like