Website malware is a serious concern for anyone hosting PHP applications, WordPress websites, business portals, custom PHP systems, or multiple domains under the same hosting account. A compromised PHP website may contain malicious files, hidden web shells, injected JavaScript, spam scripts, backdoors, phishing pages, redirect code, or heavily obfuscated PHP.

One popular Linux security utility for detecting such threats is Linux Malware Detect, commonly known as LMD or Maldet.

Linux Malware Detect is particularly relevant to web-hosting environments because it focuses on malware commonly encountered in hosted websites, including PHP shells, JavaScript injectors, encoded backdoors, and other web-application threats. Its current architecture supports multiple detection techniques including file hashes, pattern signatures, compound signatures, and YARA scanning.

However, installing Maldet on Hostinger Shared Hosting is different from installing it on a VPS or dedicated Linux server.

This article explains what is possible, what may not be possible, how to check your Hostinger account, how to scan PHP websites safely, and what alternative methods can be used when Maldet cannot be installed.

1. What Is Linux Malware Detect?

Linux Malware Detect (LMD) is an open-source malware scanner for Linux systems.

It is also commonly called:

• LMD
• Maldet
• Linux Malware Detect

The project is designed particularly around threats encountered in shared-hosted environments. It targets malware classes such as PHP shells, JavaScript injectors, encoded backdoors, IRC bots, and other web-application-level threats.

Official project:

Linux Malware Detect GitHub repository

2. What Can Maldet Detect?

LMD can help identify suspicious or known-malicious content such as:

• PHP web shells
• Backdoors
• Obfuscated PHP malware
• JavaScript injections
• Known malware signatures
• Encoded malicious payloads
• Compromised PHP scripts
• Certain uploaders
• IRC-related malware
• Modified malicious website files
• Known malware hashes
• YARA-detectable malware

Modern LMD supports detection methods including MD5/hash matching, HEX pattern matching, compound signatures and YARA scanning.

It should therefore be considered one component of a website-security investigation rather than a guarantee that a website is completely clean.

3. Why Maldet Is Useful for PHP Websites

PHP websites are frequent targets because PHP files execute server-side.

An attacker who succeeds in uploading or modifying a PHP file may potentially create a backdoor such as:

<?php
// malicious or unauthorized code could be placed here
?>

More sophisticated infections may use encoding or obfuscation to make the malicious code difficult to recognize.

Common PHP functions that deserve investigation when found in unexpected files include:

eval
base64_decode
gzinflate
shell_exec
system
exec
passthru
proc_open

However, these functions are not automatically malware.

For example, base64_decode() can be used legitimately. Therefore, never delete a file simply because a security search finds one of these functions.

4. Can Maldet Be Installed on Hostinger Shared Hosting?

This is the most important question.

The standard LMD installation places files in system-level locations including:

/usr/local/maldetect
/usr/local/sbin/maldet
/etc/cron.daily/maldet

and installs a system service.

These locations normally require elevated server permissions.

A Hostinger VPS provides server-level control, including root-level server administration, whereas ordinary shared hosting gives customers a restricted hosting environment.

Therefore, on standard Hostinger shared hosting you should not assume that the official system-wide Maldet installer can be run.

This is different from having SSH access.

SSH access means you can execute permitted commands under your hosting account. It does not automatically mean you have root access to modify the Linux operating system.

5. Hostinger Already Provides a Malware Scanner

Before attempting to install Maldet, check Hostinger's built-in security facilities.

Hostinger states that its Web and Cloud Hosting plans include an automated Malware Scanner integrated with the hosting control panel.

In hPanel, navigate to:

Websites → Dashboard → Malware Scanner

The scanner can show information such as:

• Discovered malware
• Actions taken
• Malware detection timeline
• Compromised/malicious files
• File locations

A significant limitation is that Hostinger's Malware Scanner scans website files, not the website database. Hostinger specifically warns that a clean file scan does not rule out database-level infection.

This distinction is extremely important.

6. Enable SSH Access in Hostinger

For manual investigation, SSH is extremely useful.

Hostinger currently provides SSH access on supported hosting plans and allows it to be enabled from hPanel.

Go to the SSH section in hPanel and enable SSH.

Hostinger will provide a connection command similar to:

ssh username@server-address -p PORT

Windows users can connect using PowerShell, Windows Terminal, PuTTY, or another SSH client.

Official instructions:

Hostinger SSH connection guide

7. Identify Your Website Directories

After logging in through SSH, first determine where you are:

pwd

Then:

ls -la

Do not blindly copy a path from an online tutorial.

Your account structure may differ.

You may have website directories corresponding to domains and their document roots.

Always determine the correct path before running a scan.

8. Check Whether Maldet Is Already Available

Run:

which maldet

Then:

maldet --version

If Maldet is installed and available to your hosting user, these commands should identify it.

If you receive:

command not found

Maldet is not available through your current command environment.

9. Check Whether ClamAV Is Available

Also check for ClamAV:

which clamscan

Then:

clamscan --version

If clamscan is available, it can provide another command-line malware-scanning option.

LMD itself can also integrate with ClamAV when the environment supports it.

10. Standard Maldet Installation on a VPS or Root-Controlled Server

If you have your own Linux VPS with appropriate administrative privileges, the official LMD package can be installed system-wide.

The official installer uses:

./install.sh

and installs LMD under:

/usr/local/maldetect

with a maldet command symlink under:

/usr/local/sbin/

It also configures cron and service components.

Therefore, a VPS is the appropriate environment if you specifically require complete control over Maldet installation, configuration, scheduled scanning, real-time monitoring, ClamAV integration and other server-level features.

11. Updating Maldet Signatures

If Maldet is available, update its malware signatures before scanning:

maldet -u

Keeping signatures current is important because malware continually changes.

LMD also supports automatic signature updates when installed and configured normally.

12. Scan an Entire PHP Website

Suppose the website root is:

/path/to/example.com/public_html

Run:

maldet -a /path/to/example.com/public_html

The -a operation scans files under the specified path.

Always substitute your actual website path.

13. Scan Recently Modified Files

This is one of the most useful Maldet features during a malware investigation.

For example:

maldet -r /path/to/public_html 2

scans files modified within the specified recent-day period. The official LMD quick-start documentation demonstrates this method for recently modified files.

You can apply the same idea when investigating a known compromise period.

If suspicious activity started recently, scanning recently changed files can substantially narrow your investigation.

14. Scan Multiple Websites Carefully

If your Hostinger account contains several websites, investigate all of them.

Hostinger specifically warns that on Web Hosting and Cloud Hosting plans, websites under the same account can share the same filesystem environment, meaning infection in one site can potentially affect others. Hostinger therefore recommends scanning every website on the account, not merely the website displaying symptoms.

For troubleshooting, scan websites individually:

maldet -a /path/site1/public_html

then:

maldet -a /path/site2/public_html

and:

maldet -a /path/site3/public_html

This makes it easier to identify which site contains suspicious files.

15. View Maldet Scan Reports

After a scan, Maldet creates a scan session/report.

A specific report can be displayed using its scan ID:

maldet -e SCANID

The scan ID identifies the relevant scan session.

Review the report carefully before deleting anything.

16. Quarantining Detected Malware

Maldet supports quarantining detections from a scan using:

maldet -q SCANID

This capability is documented by the LMD project.

However, do not automatically quarantine everything on a production website without review and backup.

False positives are possible.

A security scanner could flag:

• Custom PHP utilities
• Encoded commercial software
• Old scripts
• Backup utilities
• Administrative tools
• Upload scripts
• Heavily obfuscated legitimate software

The safer workflow is:

Scan → Review → Backup → Investigate → Quarantine/Clean

17. Use YARA Scanning

Modern LMD supports YARA scanning.

For example:

maldet -co scan_yara=1 -a /path/to/public_html

The official LMD documentation provides this runtime option for enabling YARA scanning.

YARA rules can help identify malware based on characteristic patterns rather than relying only on exact file hashes.

18. Manual Malware Investigation Without Maldet

Even if Maldet cannot be installed on Hostinger shared hosting, SSH gives you useful investigative tools.

For example:

grep -Rni --include="*.php" "base64_decode" /path/to/public_html

Search for eval:

grep -Rni --include="*.php" "eval(" /path/to/public_html

Search for gzinflate:

grep -Rni --include="*.php" "gzinflate" /path/to/public_html

Search for shell execution:

grep -Rni --include="*.php" "shell_exec" /path/to/public_html

And:

grep -Rni --include="*.php" "passthru" /path/to/public_html

Remember:

A match is an investigation lead—not proof of malware.

19. Find PHP Files Modified Recently

Suppose you discovered a malicious file today and suspect the compromise happened within the previous week.

Run:

find /path/to/public_html -type f -name "*.php" -mtime -7 -print

For approximately the last two days:

find /path/to/public_html -type f -name "*.php" -mtime -2 -print

For the last 30 days:

find /path/to/public_html -type f -name "*.php" -mtime -30 -print

This is an extremely useful technique because attackers frequently modify several files during the same compromise.

20. Find Recently Modified Files of Any Type

Do not investigate only .php files.

Malware can modify:

• .htaccess
• JavaScript
• HTML
• configuration files
• images containing unexpected payloads
• ZIP archives
• cron-related scripts
• cache files

Search recent files:

find /path/to/public_html -type f -mtime -7 -print

You can also investigate modification timestamps to identify clusters of suspicious changes.

21. Search for Unexpected ZIP Archives

Attackers may occasionally create archives containing scripts, stolen data, malware components or deployment files.

Search for ZIP files:

find /path/to/public_html -type f -name "*.zip" -print

Search recently modified ZIP files:

find /path/to/public_html -type f -name "*.zip" -mtime -30 -print

Do not delete every ZIP file.

Backups, plugins, themes and legitimate applications may also use ZIP archives.

The key question is:

Do you recognize the file, and can you explain why it exists?

22. Search the Entire Hosting Account for a Known Malicious Filename

Suppose you discover:

malicious-file.php

on one website.

Instead of checking only that website, search every accessible domain directory:

find ~/domains -type f -name "malicious-file.php" -print

If you discover a suspicious archive:

unknown-package.zip

search for it:

find ~/domains -type f -name "unknown-package.zip" -print

Finding identical suspicious files across multiple domains strongly indicates that the compromise may extend beyond a single website.

23. Investigate Suspicious Directories

Malware sometimes creates directories with random or numeric names.

Examples might resemble:

/assets/583721/
/uploads/829462/
/cache/748291/

These names alone do not prove infection.

Investigate their contents:

ls -la /path/to/suspicious-directory

and:

find /path/to/suspicious-directory -type f -print

Unexpected PHP files inside directories intended only for images, cache files or static assets deserve particular attention.

24. PHP Files Inside Image or Upload Directories

Suppose your website has:

/images/
/assets/
/uploads/

If these directories should contain only media/static files, search them for PHP:

find /path/to/public_html/uploads -type f -name "*.php" -print

Similarly:

find /path/to/public_html/images -type f -name "*.php" -print

and:

find /path/to/public_html/assets -type f -name "*.php" -print

Finding PHP there is not conclusive, but it deserves investigation if your application architecture does not require executable PHP in those directories.

25. Inspect .htaccess

A compromised .htaccess can cause:

• malicious redirects
• unwanted rewrite rules
• phishing redirects
• spam-page routing
• execution changes
• access restrictions
• hidden malware behavior

Hostinger itself identifies unexpected .htaccess deny rules and unfamiliar root files as possible signs of malware compromise.

Locate .htaccess files:

find /path/to/public_html -name ".htaccess" -print

Then carefully inspect unfamiliar changes.

26. Malware May Be Hidden Inside index.php

A filename such as:

index.php

does not make a file legitimate.

Attackers deliberately use common filenames including:

index.php
config.php
functions.php
admin.php
login.php
header.php
footer.php

Hostinger also identifies unfamiliar root files and index.php files containing large amounts of unreadable code as possible indicators of infection.

Therefore, evaluate:

• file location
• modification date
• owner
• permissions
• contents
• whether the application legitimately created it

27. Check WordPress Separately

If one or more websites run WordPress, also investigate:

wp-admin
wp-includes
wp-content/plugins
wp-content/themes
wp-content/uploads

Pay particular attention to unexpected PHP files under:

wp-content/uploads

Also update:

• WordPress core
• Plugins
• Themes

Hostinger identifies outdated applications and outdated or untrusted extensions as common compromise vectors.

28. Do Not Forget the Database

A major mistake is assuming:

“Malware Scanner says clean, therefore my entire website is clean.”

That is not necessarily true.

Hostinger explicitly states that its Malware Scanner scans website files but does not scan or clean the database. Database infections can exist in tables such as WordPress wp_options, wp_posts or wp_users.

Therefore, if malicious redirects or spam return after cleaning files, investigate the database too.

For WordPress, inspect suspicious:

• administrator users
• wp_options
• posts/pages containing injected scripts
• unfamiliar URLs
• malicious JavaScript
• injected iframe code

For custom PHP systems, inspect tables containing:

• HTML
• templates
• settings
• scripts
• user-generated content
• redirect URLs

29. Why Malware Comes Back After Deletion

Deleting the detected malware does not necessarily remove the vulnerability.

For example:

Attack →
Vulnerable PHP Script →
Malware Uploaded →
Malicious File Detected →
File Deleted

If the vulnerable PHP script remains:

Vulnerable PHP Script →
Attacker Returns →
Malware Uploaded Again

Therefore, proper malware removal must identify both:

the malicious file and the entry point.

30. Common Sources of Website Compromise

Potential causes include:

Outdated CMS

Old WordPress/Joomla/other CMS versions may contain known vulnerabilities.

Vulnerable Plugins

Outdated plugins are frequent attack vectors.

Vulnerable Themes

Abandoned or outdated themes can contain exploitable code.

Nulled Software

Pirated themes/plugins may contain pre-installed backdoors.

Weak Passwords

Weak FTP, SSH, CMS or hosting credentials may be compromised.

Compromised Computer

Malware on an administrator's computer may steal credentials.

Hostinger lists outdated applications, outdated or nulled extensions, compromised passwords and infected local computers among common causes of website compromise.

31. Recommended Malware Investigation Workflow

For a production PHP website, a safer procedure is:

Step 1 – Backup

Create a complete backup of:

• Website files
• Database
• Configuration files

Do this before deleting suspicious files whenever practical.

Step 2 – Run Hostinger Malware Scanner

Open:

hPanel → Websites → Dashboard → Malware Scanner

Review every detected file.

Step 3 – Enable SSH

Use SSH for deeper investigation.

Step 4 – Check for Maldet

which maldet

Step 5 – Check for ClamAV

which clamscan

Step 6 – Scan with Maldet if available

maldet -u
maldet -a /path/to/public_html

Step 7 – Search recently modified PHP files

find /path/to/public_html -type f -name "*.php" -mtime -7 -print

Step 8 – Search suspicious constructs

grep -Rni --include="*.php" "base64_decode" /path/to/public_html

and other relevant patterns.

Step 9 – Inspect suspicious directories

Look especially at:

uploads
images
assets
cache
tmp

Step 10 – Check .htaccess

Review unauthorized rewrite or redirect rules.

Step 11 – Investigate the database

Especially when symptoms continue after file cleanup.

Step 12 – Remove the vulnerability

Update or replace vulnerable software.

Step 13 – Change credentials

Change relevant:

• Hostinger password
• SSH/SFTP credentials
• FTP credentials
• CMS administrator passwords
• Database credentials where appropriate

Step 14 – Scan administrator computers

Credential-stealing malware on a local PC can result in repeated website compromises.

Step 15 – Monitor for reinfection

If suspicious files return, do not simply keep deleting them. Determine what process, account, cron job, vulnerable application or other compromised website is recreating them.

32. Should You Automatically Delete Maldet Detections?

Generally, no.

On an active production website, first review the detection.

A safer procedure is:

Detection
   ↓
Inspect File
   ↓
Compare With Known-Good Copy
   ↓
Backup
   ↓
Determine Whether Malicious
   ↓
Quarantine/Replace/Delete
   ↓
Find Entry Point
   ↓
Rescan

Automatic deletion can break a website if a legitimate file is incorrectly classified.

33. Maldet vs Hostinger Malware Scanner

These tools should not necessarily be viewed as competitors.

Hostinger Malware Scanner is convenient because it is integrated directly into the hosting environment.

Maldet is useful where you have sufficient Linux access and want additional command-line investigation and control.

For Hostinger shared hosting, start with:

Hostinger Malware Scanner + SSH investigation

For a VPS where you control the server, you can build a broader stack involving:

Maldet + ClamAV + YARA + scheduled scanning + server monitoring

34. Shared Hosting vs VPS for Maldet

Hostinger Shared Hosting

Best approach:

• Hostinger Malware Scanner
• SSH where supported
• manual find and grep analysis
• WordPress security scanner where applicable
• database inspection
• backups
• file comparison
• password rotation

VPS

A VPS is more appropriate when you require:

• system-wide Maldet
• root access
• custom malware policies
• scheduled server scans
• real-time monitoring
• ClamAV integration
• custom YARA rules
• advanced Linux security tooling

35. Important Security Rule for Multiple Websites

If you host multiple websites in the same hosting account and discover malware on one of them, do not scan only that domain.

Check every website.

Hostinger specifically warns that on Web and Cloud Hosting environments, one infected site can potentially affect other sites within the account.

Therefore:

Website A infected
        ↓
Scan Website A
        ↓
Scan Website B
        ↓
Scan Website C
        ↓
Scan remaining sites
        ↓
Investigate common entry point

This is especially important when several websites share credentials, applications, scripts or filesystem access.

36. Can Maldet Guarantee That a Website Is Clean?

No.

No single malware scanner should be treated as absolute proof that a website is clean.

A thorough security investigation may require:

• malware signature scanning
• YARA scanning
• recently modified file analysis
• file integrity comparison
• access-log review
• PHP source-code inspection
• database inspection
• CMS user review
• plugin/theme auditing
• credential changes
• local PC scanning
• recurring monitoring

Think of Maldet as an important detection layer, not a complete incident-response solution.

37. Recommended Security Architecture for PHP Websites

A strong practical approach is:

Hostinger Malware Scanner
            +
       SSH Analysis
            +
      File Backups
            +
  Recently Modified File Check
            +
     PHP Code Inspection
            +
      Database Inspection
            +
 CMS/Plugin/Theme Updates
            +
      Password Rotation
            +
    Local Computer Scan
            +
      Ongoing Monitoring

This provides significantly better protection than relying on one antivirus product.

38. Useful Command Reference

Find Maldet

which maldet

Check Maldet version

maldet --version

Update signatures

maldet -u

Scan website

maldet -a /path/to/public_html

Scan recent files

maldet -r /path/to/public_html 2

Display report

maldet -e SCANID

Quarantine scan detections

maldet -q SCANID

Find ClamAV

which clamscan

Find recently modified PHP

find /path/to/public_html -type f -name "*.php" -mtime -7 -print

Find ZIP files

find /path/to/public_html -type f -name "*.zip" -print

Search base64_decode

grep -Rni --include="*.php" "base64_decode" /path/to/public_html

Search gzinflate

grep -Rni --include="*.php" "gzinflate" /path/to/public_html

Search eval

grep -Rni --include="*.php" "eval(" /path/to/public_html

These commands are useful for investigation, but their output must be interpreted carefully.

Frequently Asked Questions (FAQ)

1. What is Linux Malware Detect?

Linux Malware Detect, or LMD/Maldet, is a Linux malware scanner designed particularly around malware threats commonly encountered in hosted web environments.

2. Is Maldet free?

Yes. Linux Malware Detect is released as open-source software under the GNU GPLv2 license.

3. Is Maldet suitable for PHP websites?

Yes. It is particularly relevant for identifying web-application malware such as PHP shells, encoded backdoors and JavaScript injectors.

4. Can I install Maldet normally on Hostinger Shared Hosting?

Usually you should not assume this is possible because the standard installer writes to system locations and configures system services/cron components. Shared hosting does not provide the same administrative control as a VPS.

5. Does Hostinger have its own malware scanner?

Yes. Hostinger provides an automated Malware Scanner for its Web and Cloud Hosting plans.

6. Where is Hostinger Malware Scanner?

Generally:

hPanel → Websites → Dashboard → Malware Scanner

according to Hostinger's current documentation.

7. Does Hostinger Malware Scanner check the database?

No. Hostinger states that its Malware Scanner scans website files, not the database.

8. Can a website therefore be infected even if Hostinger reports clean files?

Potentially, yes. Malicious content can exist in a database or use techniques that are not detected by a particular scan.

9. Can I use SSH on Hostinger?

SSH is available on supported Hostinger hosting plans and can be enabled through hPanel.

10. How do I check whether Maldet exists?

Run:

which maldet

11. How do I update Maldet?

Run:

maldet -u

12. How do I scan an entire website?

Use:

maldet -a /path/to/public_html

13. How do I scan recently modified files?

For example:

maldet -r /path/to/public_html 2

14. Should I automatically delete everything Maldet detects?

No. Review detections first because false positives are possible.

15. Can Maldet quarantine files?

Yes. Maldet supports quarantining detections associated with a scan ID.

16. What is a Maldet scan ID?

It identifies a particular scan session and allows you to review or perform actions on that scan.

17. Can Maldet use YARA?

Yes. Current LMD supports YARA scanning.

18. Can Maldet work with ClamAV?

Yes. LMD includes ClamAV integration capabilities where ClamAV is installed and accessible.

19. Is base64_decode() proof of malware?

No. It is a legitimate PHP function that malware may also abuse.

20. Is eval() always malicious?

No. However, unexpected or heavily obfuscated use of eval() deserves careful investigation.

21. Why should recently modified files be checked?

Attackers frequently create or modify several files during a compromise, so modification dates can help establish the scope and timeline.

22. Why should ZIP files be checked?

Unexpected archives may have been uploaded or created during an attack, although legitimate websites also use ZIP files.

23. Should PHP files exist inside /uploads/?

It depends on the application. If your upload directory is intended only for media/documents, unexpected executable PHP files should be investigated.

24. Why do malicious files sometimes return after deletion?

The original vulnerability or backdoor may still exist, allowing malware to be recreated.

25. Can one infected website affect another website?

Potentially yes when websites share the same hosting-account filesystem environment. Hostinger specifically recommends scanning all websites on an affected Web or Cloud Hosting account.

26. Should I change passwords after a website infection?

Yes. Relevant hosting, FTP/SFTP, SSH, CMS and other credentials should be reviewed and changed as part of incident response.

27. Should the administrator's PC also be scanned?

Yes. Credential-stealing malware on a local computer can result in repeated website compromise. Hostinger identifies infected local computers as one possible source of account compromise.

28. Can an outdated WordPress plugin cause malware infection?

Yes. Vulnerable/outdated plugins and themes are common website attack vectors.

29. Are nulled WordPress plugins dangerous?

They can be. Hostinger warns that unofficial copies of paid extensions may have been modified to include malware.

30. Is Maldet enough to secure a website?

No. Combine malware scanning with updates, backups, credential security, code review, database inspection and monitoring.

Conclusion

Linux Malware Detect is a valuable security tool for Linux web servers, particularly because it focuses on threats frequently found in shared web-hosting environments such as PHP shells, JavaScript injectors and encoded backdoors.

However, Hostinger Shared Hosting should not be treated like a VPS. The normal Maldet installation uses system-level locations and services, so full installation and configuration generally requires server-level administrative control.

For Hostinger shared-hosting users, the practical approach is:

Hostinger Malware Scanner → SSH investigation → recently modified file analysis → PHP code inspection → database inspection → cleanup → vulnerability removal → credential changes → rescan and monitor.

If you require full control over Maldet, ClamAV, YARA, scheduled malware scanning and server-level security policies, a Linux VPS is the more appropriate environment.

Most importantly, malware removal should never stop at deleting the detected file. Determine how the malicious file arrived, fix that vulnerability, check every website sharing the hosting environment, inspect the database where relevant, rotate compromised credentials, and then monitor for reinfection.

Tags

#LinuxMalwareDetect #Maldet #LMD #LinuxSecurity #Hostinger #HostingerSecurity #SharedHosting #PHP #PHPSecurity #PHPWebsite #MalwareScanner #WebsiteMalware #MalwareDetection #MalwareRemoval #WebsiteSecurity #WebSecurity #CyberSecurity #LinuxMalware #PHPScanner #PHPBackdoor #WebShell #WebShellDetection #PHPVirus #MaliciousPHP #PHPInjection #WebsiteHacked #HackedWebsite #HostingerMalware #HostingerSSH #SSH #ClamAV #YARA #WordPressSecurity #WordPressMalware #WebsiteProtection #WebsiteSecurityAudit #MalwareAnalysis #MalwareCleanup #BackdoorDetection #WebsiteBackdoor #PHPDeveloper #LinuxServer #VPS #HostingSecurity #PublicHTML #WebsiteAdministrator #SysAdmin #SecurityGuide #MalwarePrevention #IncidentResponse