If your website or application allows users to upload files—such as profile pictures, PDF documents, or CSV imports—you have introduced a significant attack vector to your VPS. Malicious actors frequently attempt to bypass frontend validations to upload "webshells." These are scripts (often written in PHP, Python, or Node.js) disguised as harmless files that, once executed by the web server, grant the attacker remote control over your directories.

While tools like Rootkit Hunter (rkhunter) protect your core operating system binaries, they do not scan your application's public web folders. ClamAV is an open-source, highly versatile antivirus engine designed specifically to detect trojans, viruses, and malicious scripts hidden within standard file uploads.

Installing ClamAV and the Daemon

ClamAV can be installed on almost any Linux distribution. For performance, it is highly recommended to install both the base scanner and the ClamAV daemon, which keeps the antivirus engine loaded in your server's memory for significantly faster scanning.

• Connect to your server via SSH as a user with sudo privileges.

• Update your package lists by running sudo apt update.

• Install the necessary packages by executing sudo apt install clamav clamav-daemon.

• Once the installation completes, stop the background daemon temporarily so you can perform the initial signature update without conflicts: sudo systemctl stop clamav-daemon.

Updating the Malware Database

An antivirus is only as effective as its signature database. Malicious scripts evolve constantly, so you must ensure ClamAV is aware of the latest threats before running your first scan.

• The ClamAV package includes a utility called freshclam that handles database updates. Run it manually by executing sudo freshclam.

• The terminal will output the download progress of the main, daily, and bytecode .cvd database files.

• Once the update is complete, start the daemon back up and enable it to run at boot: sudo systemctl start clamav-daemon sudo systemctl enable clamav-daemon

Note: The freshclam service automatically runs in the background by default on Debian/Ubuntu systems, ensuring your database stays current without daily manual intervention.

Scanning Your Web Directories

With the engine primed, you can now initiate a scan of your publicly accessible web directories. It is best practice to run this manually the first time to observe the output and ensure it does not mistakenly flag legitimate application scripts (false positives).

• To scan a specific directory (e.g., your Nginx or Apache web root), use the clamscan command.

• Run the command with the infected-only flag and recursive flag: sudo clamscan -r -i /var/www/mywebsite/

• -r (recursive): Tells the scanner to check all folders and subfolders within the target directory.

• -i (infected): Instructs the scanner to only output the names of files it actively believes are malicious, suppressing the output of thousands of clean files.

• Depending on the size of your web directory, this scan may take several minutes. Once finished, it will provide a summary of scanned files and any detected threats.