scan.sh

#!/bin/bash

# Rootkit & Malware Scanner (ClamAV + RKHunter)
# Created by Hosteons - https://hosteons.com

# Detect OS
if [ -f /etc/os-release ]; then
    . /etc/os-release
    OS=$ID
else
    echo "Unsupported OS"
    exit 1
fi

echo "Detected OS: $OS"

# Update package lists
if [[ "$OS" == "ubuntu" || "$OS" == "debian" ]]; then
    apt update
    apt install -y clamav rkhunter
elif [[ "$OS" == "centos" || "$OS" == "almalinux" ]]; then
    yum install -y epel-release
    yum install -y clamav clamav-update rkhunter
else
    echo "Unsupported OS"
    exit 1
fi

# Stop freshclam to avoid log conflicts
echo "Stopping freshclam daemon to avoid log conflicts..."
systemctl stop clamav-freshclam 2>/dev/null || pkill -f freshclam 2>/dev/null

# Update ClamAV definitions
echo "Updating ClamAV database..."
freshclam || echo "ClamAV update may have failed. Check /var/log/clamav/freshclam.log"

# Fix invalid WEB_CMD in RKHunter if needed
if grep -q '^WEB_CMD="/bin/false"' /etc/rkhunter.conf 2>/dev/null; then
    echo "Fixing invalid WEB_CMD in /etc/rkhunter.conf"
    sed -i 's|^WEB_CMD="/bin/false"|WEB_CMD=DISABLE|' /etc/rkhunter.conf
fi

# Update RKHunter
echo "Updating RKHunter database..."
rkhunter --update

# Scan for malware and rootkits
echo "Running ClamAV scan..."
clamscan -r --bell -i / 2>/dev/null

echo "Running RKHunter scan..."
rkhunter --check --sk --nocolors

echo "Scan complete"