I have a ubuntu server which have some WordPress sites, yesterday I found one site crashed due to malware. Can any one suggest me how can I remove malware from ubuntu server?

Thanks in advance

  • 5
    Specify malware. Give us more information. – Eduardo Cola Jan 5 '16 at 13:03

This may sound like an overkill answer, but one of the only ways to be sure is to Nuke It From Orbit.

The problem with malware, especially ones which infect a Wordpress instance, is that unless you've tracked exactly what that malware did, there's no way to know the extent of the infection. Malware could have infected key operating system services, or downloaded additional services to run on the system, or any thousands of potential additional problem-causing tasks.

The tried and true way, unfortunately, to get rid of malware is to rely on backups of your critical data for restoring, and then blow away the system. From that point, you would then reinstall the OS and packages you need, and then restore critical files from known clean backups.

This is, unfortunately, one of the only ways to be absolutely sure that you got rid of the malware and any traces left over of it. I've had malware on one of my servers before, and even removing Wordpress didn't stop it; I had to Nuke It From Orbit to get the thing cleaned. Ended up destroying that server's disks, wiping out the old Wordpress blog I had, and spinning up a new instance on a new domain, starting out fresh.


Install ClamAV using the following command:

sudo apt-get install clamav

And scan viruses (and update virus databases) using the following command:

sudo freshclam; clamscan -r /

Enjoy ClamAV!

  • 1
    I would NOT trust this to be an all-inclusive protection. This does not catch a majority of viruses, though it's decent. If the Malware is not in fact a virus executable and something injected into the Wordpress functionality such as a script or such that runs inside Wordpress, it likely won't get detected by ClamAV. (The only tried-and-true way to get rid of malware is the Nuke It From Orbit approach, as I referenced in my answer) – Thomas Ward Jan 5 '16 at 13:17

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.