Linux Malware Detect (LMD) review

Linux Malware Detect, known as maldet, fills a gap that desktop antivirus leaves: malicious PHP and script files on web servers. R-fx Networks says it is designed around the threats faced in shared hosted environments, and its signatures come from intrusion detection data on network edges, so they reflect malware used in real attacks. Version 2.0.1 rebuilt the scanning engine, and detection runs in five stages covering MD5 hashes, HEX patterns, YARA, ClamAV and statistical checks for obfuscated code such as base64 and gzinflate. Real-time monitoring uses inotify, and alerts can go to email, Slack, Discord or Telegram. Detected files land in a quarantine with audit logs, and cleaner rules can strip injected strings. For an Ubuntu laptop it is the wrong tool, since it does not focus on desktop threats and installs from source. For anyone hosting WordPress or other sites on a Linux box, it is a strong free companion to ClamAV.

Who it is for

People running web servers or self-hosted sites on Linux who want to catch web shells and injected code.

Price

Free and open source under GNU GPL v2.

Licensed under GNU GPL v2
Quoted from the vendor pricing page on November 10, 2026.

Key features

• Five detection stages: MD5, HEX pattern, YARA, ClamAV and statistical analysis
• Kernel-based inotify real-time monitoring
• Native YARA-X integration for polymorphic threats
• Quarantine queue with audit logging and cleaner rules for injected code
• Email, Discord, Slack and Telegram alerts

Strengths and weaknesses

• Strength: Free with active development and a 2.0.1 release
• Strength: Signatures based on malware seen in real attacks on hosting servers
• Strength: Can export signatures to ClamAV for layered scanning
• Weakness: Designed for shared hosting, not desktop threats
• Weakness: Installed from source with a shell script
• Weakness: No graphical interface

Key facts

• License: GNU GPL v2
• Latest release: v2.0.1
• Project age: Since 2005
• Real-time method: inotify monitoring

Where it ranks

Linux Malware Detect (LMD) is No. 8 in our Best Antivirus for Linux verdict.