Linux Malware Detect

To protect Linux systems against vulnerabilities, various software packages are available, such as rootkit detectors such as Rootkit Hunter and chkrootkit, and auditing systems like lynis. Malware detection software such as LMD and ClamAV improve the security of systems by scanning them based on the signatures of thousands of instances of known malware.

For malware signatures, LMD uses various sources such as the signatures database of ClamAV and the Malware Hash Registry of Team Cymru. Besides such third party signature databases, it also maintains its own database of signatures.

If a ClamAV scanner engine is already available on a system, LMD will use this for its scanner engine. This will normally give better performance than its built-in scanner engine.

LMD can quarantine malware, and it can clean software that contains malicious code.

The executable command of LMD is maldet. Typical command invocations are maldet -d, to check for later versions; maldet -u, to check for malware signature updates; and maldet -a, to scan the file system of the server on which LMD resides. Checking for malware signature updates is typically done in an automated manner. Besides periodic scans, real-time monitoring is also supported with the --monitor command-line argument. LMD can monitor users, paths and files in such a way.

Linux Malware Detect is one of the objectives for the LPI 303 certification.