Guys,

Linux Malware Detect (LMD) uses MD5 file hashes and hex pattern matches to identify malware. The goal of LMD is to provide a threat detection, alerting and quarantine tool for Linux web servers, though the MD5/hex signatures are portable to any number of detection tools.

Installation

root@server [~]# wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
2010-05-15 23:34:05 (148 MB/s) - `maldetect-current.tar.gz' saved [268031/268031]

root@server [~]# tar xfz maldetect-current.tar.gz
root@server [~]# cd maldetect-*
root@server [~]# ./install.sh

Usage

If we wanted to scan all user public_html paths under /home*/ this can be done with:

maldet --scan-all /home?/?/public_html

If you wanted to scan the same path but scope it to content that has been created/modified in the last 5 days you would run:

maldet --scan-recent /home?/?/public_html 5

If you want to scan a user public_html directory use

maldet --scan-all /home/username/public_html