---
title: "How to Install and Configure maldet"
description: "HOW TO INSTALL LINUX MALWARE DETECT (LMD) Maldet also known as Linux Malware Detect virus scanner for Linux. Linux Malware Detect (LMD) is a malware scanner for Linux released under the GNU GPLv2 lice..."
url: https://blog.philmorehost.com/install-configure-maldet/
date: 2025-06-22
modified: 2025-06-22
author: "PHILMOREHOST"
image: https://blog.philmorehost.com/wp-content/uploads/2017/10/anti-maldet.png
categories: ["WHM/cPanel Tutorial"]
type: post
lang: en
---

# How to Install and Configure maldet

## HOW TO INSTALL LINUX MALWARE DETECT (LMD)

Maldet also known as Linux Malware Detect virus scanner for Linux.

Linux Malware Detect (LMD) is a malware scanner for Linux released under the GNU GPLv2 license, that is designed around the threats faced in shared hosted environments. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks and generates signatures for detection. In addition, threat data is also derived from user submissions with the LMD checkout feature and from malware community resources. The signatures that LMD uses are MD5 file hashes and HEX pattern matches, they are also easily exported to any number of detection tools such as ClamAV.

To install LMD, download the package and run the enclosed install.sh script
Download maldetect package using wget

Go to the below path

> cd /usr/local/src/

Download the tar file using the below link:

> wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

Extract the file using the below command

> tar -xzf maldetect-current.tar.gz

go to the maldet folder

> cd maldetect-*

Now, run the below command to install maldet.

> sh ./install.sh or sudo sh ./install.sh

It will give below output

> Linux Malware Detect v1.3.4
> (C) 1999-2010, R-fx Networks
> (C) 2010, Ryan MacDonald
> inotifywait (C) 2007, Rohan McGovern
> This program may be freely redistributed under the terms of the GNU GPL
> installation completed to /usr/local/maldetect
> config file: /usr/local/maldetect/conf.maldet
> exec file: /usr/local/maldetect/maldet
> exec link: /usr/local/sbin/maldet
> cron.daily: /etc/cron.daily/maldet
> maldet(32517): {sigup} performing signature update check…
> maldet(32517): {sigup} local signature set is version 2010051510029
> maldet(32517): {sigup} latest signature set already installed

 

#### Step 3: Configuring LMD

By default all options are fully commented in the configuration file, so configure it according to your needs. But before making any changes let’s have a detailed review of each option below.

1. **email_alert** : If you would like to receive email alerts, then it should be set to 1.
2. **email_subj** : Set your email subject here.
3. **email_addr** : Add your email address to receive malware alerts.
4. **quar_hits** : The default quarantine action for malware hits, it should be set 1.
5. **quar_clean** : Cleaing detected malware injections, must set to 1.
6. **quar_susp** : The default suspend action for users wih hits, set it as per your requirements.
7. **quar_susp_minuid** : Minimum userid that can be suspended.

Open file **/usr/local/maldetect/conf.maldet** and make changes according to your needs

```
# nano /usr/local/maldetect/conf.maldet
```

 

To update the maldet use the below commands.

> maldet –update-ver
> maldet –update maldet -u or maldet -d

 

To scan the files. perticular user

> maldet -a /home/username/

It will scan all the files and provide you the output.

To scan all user uder public_html paths under /home*/ this can be done with:

> root@server[~]# maldet –scan-all /home?/?/public_html

```
root@server[~]-maldet --scan-all /home
```

 

To scan the same path but the content that has been created/modified in the last 5 days:

> root@server[~]# maldet –scan-recent /home?/?/public_html 5

To scan but forget to turn on the quarantine option, you could quarantine all malware results from a previous scan with:

> root@server[~]# maldet –quarantine SCANID

If you wanted to attempt a clean on all malware results from a previous scan that did not have the feature enabled, you would do with.

> root@server[~]# maldet –clean SCANID

If you had a file that was quarantined from a false positive or that you simply want to restore (i.e: you manually cleaned it), you can use the following:

> root@server[~]# maldet –restore config.php.2384
> root@server[~]# maldet –restore /usr/local/maldetect/quarantine/config.php.2384