Checking a VPS for Viruses

How to Scan a VPS for Viruses

🔹 Why You Should Scan Your VPS

Even Linux servers are not immune to threats. Vulnerable plugins, outdated CMS versions, or weak passwords can expose your system to malicious scripts. Regular virus scans help prevent hacking, data leaks, or IP address blacklisting.

🔹 How to Perform the Scan

1. Connect to your server
Access your server via SSH:

ssh root@your_server_ip

2. Install the ClamAV antivirus
ClamAV is a free antivirus for Linux that effectively detects malicious files.
To install it, run:

apt install clamav -y

🧩 For CentOS / AlmaLinux / Rocky Linux, use:

yum install clamav -y

3. Update the virus database
After installation, update the virus definitions so the antivirus can detect the latest threats:

freshclam

4. Start scanning
To scan the entire server:

clamscan -r /

To scan only the user’s home directory:

clamscan -r /home

5. Review the results
Files containing viruses will be marked as Infected.
You can remove them manually or automatically:

clamscan -r --remove /

⚠️ Be careful: this command will delete all infected files without confirmation.

🔹 Additional Tips

Keep your system up to date to prevent known vulnerabilities:

apt update && apt upgrade -y

Enable a firewall (such as UFW or iptables) and install Fail2Ban to block brute-force login attempts.
Avoid working as the root user — create a separate account with limited privileges.

🔹 If the server runs on Windows

1. Connect via RDP.
2. Install an antivirus such as Windows Defender or ESET.
3. Run a full system scan.
4. Remove any detected threats.