Malware on VPS: How to Detect and Clean Your Server

If you suspect your VPS has malware, here is the direct answer: look for abnormal processes, recently modified system files, and unauthorized outbound network connections. Three commands can give you a clear first picture in under five minutes.

Below you will find a complete process: warning signs, free analysis tools, and the steps to clean the infection and harden your server.

Signs Your VPS Might Be Infected

Not every odd behavior is malware, but these signals warrant immediate investigation:

• CPU or RAM at 100% for no clear reason. A hidden mining process or DDoS bot consumes resources continuously.
• Unusual network traffic. Outbound connections to unknown IPs or bandwidth spikes outside business hours.
• Recently modified system files. System binaries that nobody should have touched, showing today's timestamp.
• New users or SSH keys. Unexpected lines in /etc/passwd or in ~/.ssh/authorized_keys.
• IP or domain blacklisting. Your domain or IP appears on spam blacklists, or your outgoing email bounces.
• Abuse notice from your provider. Notifications about port scanning, spam, or outbound attacks originating from your server.

Commands to Detect Malware Quickly

Run these commands as root (or with sudo) for a first sweep.

Suspicious processes

# Processes sorted by CPU usage
top -b -n 1 | head -20

# All processes with their real executable path
ps aux --sort=-%cpu | head -20

# Find processes with no visible name (rootkit trick)
ls /proc/*/exe 2>/dev/null | xargs -I{} readlink {} 2>/dev/null | sort -u

Active network connections

# Established connections with the originating process
ss -tunap

# Listening on non-standard ports
ss -tlnp | grep -v ':22\|:80\|:443\|:3306'

Recently modified files in critical paths

# Files changed in the last 24 hours under /bin /usr /etc /tmp
find /bin /usr/bin /usr/sbin /etc /tmp -mtime -1 -ls 2>/dev/null

Hidden cron jobs

# Crontabs for all users
for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u "$u" 2>/dev/null && echo "--- $u"; done

# Files in /etc/cron.* and /var/spool/cron
ls -la /etc/cron.* /var/spool/cron/crontabs/ 2>/dev/null

Free Scanning Tools

Manual commands have limits. These tools automate detection and recognize known malware signatures.

Full scan example with ClamAV:

clamscan -r --bell -i /var/www /home /tmp /usr/local/bin 2>/dev/null

Example with rkhunter:

rkhunter --update && rkhunter --checkall --skip-keypress 2>&1 | grep -E 'Warning|Infected'

Steps to Clean the Infection

Once the infection is confirmed, follow this order. Rushed cleanup without understanding the scope can leave active backdoors behind.

1. Isolate the server. Block unnecessary outbound traffic with your firewall to stop exfiltration or attacks against third parties.
2. Preserve evidence. Copy current logs (/var/log/auth.log, /var/log/syslog, /var/log/apache2/) before they rotate or get deleted.
3. Identify the entry vector. Review SSH access logs (lastlog, last, /var/log/auth.log) and your web server logs to find the request that opened the door.
4. Delete malicious files. Remove only what you have positively identified. If using ClamAV with --remove, confirm each file before deletion.
5. Revoke compromised access. Change all passwords, regenerate SSH keys, remove unrecognized users from /etc/passwd, and clean authorized_keys.
6. Update all software. Apply OS patches, CMS updates, plugin upgrades, and dependency patches. The exploited vulnerability may still be open.
7. Restore from a clean backup if in doubt. If you cannot confirm the system is 100% clean, a reinstall from a known-good image is safer than manual cleanup.

For a broader look at server hardening, browse the VPS server security guides in our resource center.

Prevention: Avoiding the Next Infection

Reactive detection is necessary, but prevention is far cheaper. These practices dramatically reduce your attack surface:

• Disable password-based SSH login. Use only SSH keys and disable direct root access.
• Keep the system updated. Enable automatic security updates or review them weekly.
• Use a strict firewall. Open only ports you genuinely need. ufw default deny incoming is a solid starting point.
• Monitor with Fail2ban. Auto-block IPs that brute-force SSH, WordPress, FTP, and mail services.
• Run automated backups off-server. A backup stored on the same VPS offers no protection if the attacker has root access.
• Schedule a nightly scanner. Set up ClamAV or Maldet to run every night and email you the report.

For a comprehensive security approach, the specialists at elenlace.com can audit your VPS and set up continuous monitoring so you are never flying blind.

Key Takeaways

• The most common malware symptoms on a VPS are unexplained CPU/RAM spikes, abnormal outbound connections, and modified system files.
• top, ss -tunap, and find give you a solid first diagnosis in minutes.
• ClamAV, rkhunter, and chkrootkit are free tools that automate detection of known malware signatures.
• Cleanup must follow a sequence: isolate, preserve evidence, identify the vector, remove files, revoke access, and update everything.
• Prevention (key-based SSH, strict firewall, automatic updates) costs far less than remediation.

If you suspect your server is compromised or want to harden it before an incident occurs, reach out to elenlace.com for a professional security review.

FAQ

Can I clean malware without reinstalling the server?

In many cases, yes — especially if the infection is limited to web files (webshells, malicious PHP scripts). If there is a rootkit that has compromised system binaries or the kernel, a clean reinstall is the only reliable option.

How long does a full ClamAV scan take?

It depends on disk size. On a VPS with 20 GB of data, expect 10 to 40 minutes. You can scope the scan to /var/www and /home for faster results if you are only concerned about web files.

Does rkhunter always give false positives?

Yes, especially after system updates, because it compares current binaries against a baseline. When a warning appears, manually verify whether the change corresponds to a legitimate package update before raising the alarm.

Will my VPS provider notify me if there is malware?

Some providers monitor network traffic and alert you if your server generates abuse (spam, port scanning). However, they do not actively scan your files — that responsibility is yours. That is why setting up an automatic scanner from day one is so important.

Compare providers

Other providers and guides worth comparing:

• GoDaddy
• HostGator México
• Hostinger