How can I check an Ubuntu-based system for malware?

Be careful about installing random software or copying commands from untrusted websites. On a typical Ubuntu-based system, checking recently installed packages, running processes, startup services, and browser extensions can be just as useful as an antivirus scan. ClamAV can detect known malicious files, but it may not explain every unusual system behavior.

If you have strong evidence that the system was compromised—especially if an attacker gained root access—the safest response is to back up only your personal documents, erase the drive, and reinstall the operating system from trusted installation media. A scanner may remove known files, but it cannot guarantee that a sophisticated compromise has been completely cleaned up.

ClamAV is the usual antivirus scanner for Linux, and ClamTK provides a graphical interface for it. Both may be available through your distribution’s software repositories. You can use ClamTK to choose specific folders or scan the whole filesystem, though scanning protected system directories may require administrator privileges. Also, what does “acting weird” mean? Malware is relatively uncommon if you only install software from trusted repositories and avoid running unknown scripts.

For a broader security review, tools such as Lynis, debsecan, AIDE, YARA, Linux Malware Detect, and Samhain can check different aspects of the system, including configuration, package vulnerabilities, file changes, and suspicious patterns. They are more specialized than ClamTK, so I’d start with ClamAV/ClamTK and basic system checks before using all of them.