Linux Malware Detect

Linux Malware Detect (LMD) is a malware scanner for Linux built for shared hosting environments. It hunts PHP shells, JavaScript injectors, base64-encoded backdoors, IRC bots, and other web-layer threats, and runs on any distribution with bash and standard GNU utilities.

Detection combines five stages: MD5 and SHA-256 hashes, HEX patterns, compound signatures, YARA, statistical analysis, and ClamAV integration. You can scan all files, recent files, or a custom list, watch create, modify, and move events in real time with inotify, and quarantine, clean, or restore affected files.

Alerting reaches email, Slack, Telegram, and Discord, and signature updates run on a cron schedule. It installs as a native Linux daemon with systemd and SysV init support, keeping the whole workflow on the host being protected.