A virtual server can have viruses just like a computer or smartphone. After all, they are united by software that can be infected by intruders.
\nIf you own VPS hosting, you should have the ability to connect to the server via SSH. By connecting through this network protocol, you will be able to install antivirus for the server or simply run it when necessary.
\nSoftware virus checking can be done through the Linux Malware Detect scanner.<\/p>\n
All manipulations are performed via SSH, so in the first stage, connect to the VPS server via SSH. After that, perform sequential actions in the PuTTY client in the console. Copy each of the 5 commands and paste them using the “Shift” + “Insert” combination, completing the operation by pressing the “Enter” key.
\nThe commands look as follows:<\/p>\n
cd \/usr\/local\/src\/\r\nwget http:\/\/www.rfxn.com\/downloads\/maldetect-current.tar.gz\r\ntar -xzf maldetect-current.tar.gz\r\ncd maldetect-*\r\nsh .\/install.sh\r\n<\/pre>\nStarting the Scan<\/h3>\n
Scanning a directory for viruses on the server is launched with the following command:<\/p>\n
maldet -b -a \/var\/www\/\r\n<\/pre>\nIf desired, you can specify a different directory for scanning.<\/p>\n
Duration and Results of Virtual Server Scanning<\/h3>\n
Searching for viruses on the server and malicious files depends on the size of the folder or directory. Consequently, the larger the folder, the longer the scanning process will be.
\nWhether scanning has completed can be determined by entering the command<\/p>\n
ps -aux | grep [m]aldet\r\n<\/pre>\nHere is the output of such a command:<\/p>\n
root 12429 17.8 0.0 118408 6304 pts\/0 S 09:24 1:35 bash \/usr\/local\/sbin\/maldet -b -a \/var\/www\/mysite.ua\/\r\n<\/pre>\nFrom this example we see that the \/var\/www\/mysite.ua\/ directory is being scanned and the process is ongoing, you just need to wait for it to finish.
\nIf when running the command it outputs nothing, then the check is finished and to see the result, run:<\/p>\n
maldet -e\r\n<\/pre>\nExample output:<\/p>\n
HOST: 78-26-128-200.vps.ukr.host\r\nSCAN ID: 160721-1022.31393\r\nSTARTED: Jul 21 2016 02:20:34 +0400\r\nCOMPLETED: Jul 21 2016 11:32:40 +0400\r\nELAPSED: 0s [find: 0s]\r\nPATH: \/var\/www\/mysite.ua\/\r\nTOTAL FILES: 23890\r\nTOTAL HITS: 1\r\nTOTAL CLEANED: 0\r\nWARNING: Automatic quarantine is currently disabled, detected threats are still accessible to users!\r\nTo enable, set quarantine_hits=1 and\/or to quarantine hits from this scan run:\r\n\/usr\/local\/sbin\/maldet -q 160721-1022.31393\r\nFILE HIT LIST:\r\n{MD5}php.cmdshell.unclassed.4690 : \/var\/www\/mysite.ua\/pgtz.php\r\n<\/pre>\nIn the example, you can see that scanning lasted 7 hours (from 02:20:34 to 11:32:40). A total of 23890 files were scanned (TOTAL FILES) and a virus was found (TOTAL HITS).<\/p>\n