How to Scan for Malware on Linux (2026): A Practical Walkthrough

You downloaded something. A .deb from a project's site, a script from a Stack Overflow answer, an AppImage a coworker swore was fine. Now there's a small voice in the back of your head asking: did I just put something nasty on my machine?

That voice is healthy. And the good news is that checking is quick, free, and doesn't require you to send a single byte to anyone's cloud. You can scan your whole home directory in the time it takes to make coffee.

This is a hands-on guide to scanning for malware on Linux in 2026 — the actual commands, what the output means, and what to do when something gets flagged. No fear-mongering. Just the steps I'd walk a friend through.

Before you start: what a scanner can and can't do

Quick reality check, because it saves disappointment later.

A signature-based scanner like ClamAV is brilliant at one thing: recognizing known malware. It compares your files against a curated database of threat signatures maintained by Cisco's Talos team (run a scan and the Known viruses: line shows today's count). If a file matches, you'll know. That covers the overwhelming majority of what a desktop user actually runs into — trojaned packages, malicious scripts, infected documents, Windows malware riding along in a shared file.

What it won't do is magically detect a brand-new, never-before-seen threat that has no signature yet. No scanner does that reliably. When the Linux variant of SystemBC was first found, none of the 62 antivirus engines on VirusTotal flagged it on day one. That's the nature of brand-new malware — detection catches up fast, but never instantly.

So treat scanning as one layer, not a force field. It catches the known stuff, which is most of the stuff. Combine it with good habits and you're in good shape.

Step 1: Install ClamAV

ClamAV is the open-source engine that does the heavy lifting. It's been maintained since 2002, Cisco took over the team in 2013, and version 1.4 is the current Long-Term Stable release as of 2026. It's in every major distro's repositories, so installation is one command.

# Ubuntu / Debian / Mint / Pop!_OS
sudo apt install clamav clamav-daemon

# Fedora
sudo dnf install clamav clamd clamav-update

# Arch / Manjaro
sudo pacman -S clamav

# openSUSE
sudo zypper install clamav

Two packages matter here. clamav gives you the command-line scanner (clamscan). clamav-daemon gives you clamd — a background service that keeps the signature database loaded in memory, which makes repeat scans dramatically faster. For a one-off check you only need the first. For anything ongoing, install both.

Step 2: Update the signatures

This is the step people skip, and it's the one that matters most. A scanner with stale signatures is worse than no scanner — it hands you false confidence. Fresh signatures are the whole game.

ClamAV updates through a tool called freshclam. On most distros a background service (clamav-freshclam) already does this for you several times a day. To force an update right now:

# Stop the auto-updater so it doesn't hold a lock
sudo systemctl stop clamav-freshclam

# Pull the latest signatures
sudo freshclam

# Start it again so updates continue automatically
sudo systemctl start clamav-freshclam

You'll see it download main.cvd, daily.cvd, and bytecode.cvd — the core database, the daily incremental updates, and the bytecode signatures for more complex detection. When it says the databases are up to date, you're ready.

Step 3: Run your first scan

Now the satisfying part. The basic scanner is clamscan. The flags you'll actually use:

# Scan a single folder, recursively, but only print infected files
clamscan -r -i ~/Downloads

# Scan your whole home directory
clamscan -r -i ~/

# Scan and show a summary at the end (drop -i to see every file checked)
clamscan -r ~/Downloads

What each flag does:

• -r — recursive, so it walks into subdirectories
• -i — only print infected files (otherwise it lists every single file it checks, which is a lot of noise)

One thing worth knowing: clamscan loads the entire signature database into memory every time it runs, which takes 15-30 seconds before scanning even begins. If you've installed the daemon, use clamdscan instead — it talks to the already-running clamd service, so it skips the load time and scans much faster:

# Faster, uses the running daemon
clamdscan -i ~/Downloads

For a full home-directory scan, that speed difference is the gap between "annoying" and "barely noticed."

Quarantine instead of just reporting

By default ClamAV tells you about threats but leaves them exactly where they are. If you'd rather it move anything suspicious into a safe holding folder, create one and point the scanner at it:

mkdir -p ~/quarantine
clamscan -r -i --move=~/quarantine ~/Downloads

Now flagged files get relocated out of harm's way, and you can inspect them later before deciding whether to delete. I prefer --move over --remove for exactly this reason — false positives happen, and you don't want a one-way trip to deletion for a file that turned out to be fine.

Step 4: Prove it actually works (the EICAR test)

Here's a trick most guides leave out. Before you trust a scanner, make sure it can actually catch something. There's a harmless, industry-standard test file called EICAR that every antivirus engine on earth is built to detect. It's not malware — it's a deliberately recognizable string that triggers a detection so you can confirm your setup works.

# Create the EICAR test file
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > ~/eicar-test.txt

# Scan for it
clamscan ~/eicar-test.txt

If everything's wired up correctly, ClamAV will report Win.Test.EICAR_HDB-1 FOUND (or similar). That's your proof the scanner is live and reading signatures. Delete the test file afterward — rm ~/eicar-test.txt — though it's completely safe to leave lying around. It can't do anything.

Run this test once after install and once every few months. It takes ten seconds and it's the difference between "I think I'm protected" and "I confirmed I'm protected."

Step 5: Read the results without panicking

When a scan finishes, you get a summary. The two lines that matter:

Infected files: 0
Scanned files: 4213

Infected files: 0 is what you want to see. Most of the time, that's exactly what you'll get.

If it's not zero, don't spiral. Read the actual detection name first. ClamAV names tend to look like Unix.Trojan.Something, Win.Malware.Something, or PUA.Something. A few notes:

• Win.* detections are Windows malware. They can't run on your Linux box, but they matter if you share that file with someone on Windows — you'd be passing the infection along. Delete it.
• PUA.* means "Potentially Unwanted Application" — things like adware bundlers or aggressive trackers. Not always malicious, but worth a look. (PUA detection is off by default; add --detect-pua=yes if you want it.)
• Unix.* / Linux.* detections are the ones to take seriously on a Linux desktop. Quarantine, investigate, and if you're unsure, search the exact detection name.

False positives are real, especially with compressed archives, game files, or certain developer tools. If a single obscure file gets flagged and nothing else does, look up the detection name before you nuke it. If your whole node_modules lights up, that's almost certainly noise, not an infection.

Going deeper: rootkits and system integrity

ClamAV scans files. But some of the nastier Linux threats — rootkits — actively hide themselves from normal file listings. For those, you want a second tool that checks system integrity rather than file contents.

Two classics, both free and both in your repos:

# Install both
sudo apt install rkhunter chkrootkit

# Run chkrootkit
sudo chkrootkit

# Update rkhunter's database, then scan
sudo rkhunter --update
sudo rkhunter --check

These compare your system binaries, kernel modules, and file permissions against known-good baselines and known rootkit fingerprints. According to the rkhunter project, it checks for SHA256 hash changes on key files, hidden files in system directories, suspicious strings in kernel modules, and executables with anomalous permissions.

One caveat that catches everybody: rkhunter and chkrootkit generate false-positive warnings constantly. A routine system update changes a binary's hash, and rkhunter flags it. That's not a rootkit — it's just a warning that something changed since the last baseline. After you update your system, run sudo rkhunter --propupd to refresh the baseline so future scans stay quiet. Don't panic at the first yellow "Warning" line; read what it's actually pointing at.

If you want the full breakdown of what a genuinely compromised system looks like versus normal noise, we wrote a separate guide on the real signs your Linux system has been hacked.

From one-off scans to always-on protection

Manual scanning is great for "I just downloaded something sketchy" moments. But you have to remember to do it. The files that actually bite people are the ones that arrive when you're not thinking about security.

You can make ClamAV watch in real time. The component is called clamonacc (on-access scanning), and it hooks into the kernel's fanotify system to scan files the moment they're written or opened. Setting it up by hand means editing clamd.conf, enabling the OnAccessIncludePath directives, configuring a systemd service, and sorting out permissions. It's doable — budget 20-30 minutes if you're comfortable in config files — and the official ClamAV documentation walks through it.

You can also automate periodic scans with a systemd timer or a cron job:

# Edit your crontab
crontab -e

# Add a weekly scan of your home directory, Sunday at 2am
0 2 * * 0 clamdscan -i --move=$HOME/quarantine $HOME >> $HOME/.clamav-scan.log 2>&1

This is exactly the kind of plumbing that separates "antivirus for sysadmins" from "antivirus for everyone." Setting up on-access scanning, quarantine, scheduled scans, and desktop notifications by hand is a real chunk of work. If you'd rather skip all of it, that's the gap XorShield AV was built to fill — the same local-first, no-telemetry protection, in a native desktop app that handles real-time monitoring, quarantine, and scheduling out of the box. None of the config files.

Everything above assumes a desktop or laptop. On a server the priorities shift — daemon-based scanning, upload directories, mail gateways — and we walk through that in Linux server antivirus in 2026.

The privacy footnote nobody mentions

Here's something worth sitting with. A lot of "free online virus scanners" and some commercial antivirus products work by uploading your files — or hashes of them — to a cloud service for analysis. That's convenient. It's also your data leaving your machine.

Everything in this guide runs locally. ClamAV scans on your CPU, against a database on your disk. The only network connection involved is freshclam downloading signature updates from clamav.net. Nothing about your files goes anywhere. You can verify that yourself — run sudo nethogs or ss -tp in another terminal while a scan runs, and watch the (lack of) traffic.

That's not a small detail. You chose Linux partly for control over your own machine. Your malware scanner should respect that, not quietly undermine it. If you want the deeper argument for why local-only scanning matters, we made the case in do you actually need antivirus on Linux.

The short version

If you just want the checklist:

1. Install ClamAV (and the daemon for speed).
2. Update signatures with freshclam — this is the step that matters most.
3. Scan with clamscan -r -i ~/ or the faster clamdscan -i ~/.
4. Confirm it works with the EICAR test file.
5. Quarantine with --move rather than deleting blind.
6. Add rkhunter or chkrootkit if you want to check for rootkits.
7. Automate it with a timer, or use a GUI that handles the plumbing for you.

None of this is hard. It's a few commands and ten minutes. And the next time that small voice asks "did I just install something bad?" — you'll have an answer instead of a worry.

Last updated: May 2026