What’s the best way to check an Ubuntu-based system for malware?

ClamAV is the usual antivirus scanner for Linux, and ClamTK provides a graphical interface for it. Both may be available through your distribution’s software repositories. That said, the symptoms matter: malware is relatively uncommon when software is installed through trusted package sources. Be especially cautious with commands copied from random websites, downloaded installers, and scripts run with administrator privileges.

For a system you strongly believe has been compromised, the most trustworthy cleanup is to back up personal data, erase the drive, and reinstall the operating system from known-good media. Before restoring files, inspect them and avoid bringing back unknown scripts or executables. For less serious concerns, tools such as Lynis, AIDE, debsecan, or malware-specific scanners can help with auditing and finding suspicious changes, but they require more manual interpretation.

If you only want a GUI, install ClamTK and configure it to scan the directories you care about. A scan of the whole filesystem may produce permission errors and lots of false positives, so you may need to run it with appropriate privileges and review detections carefully rather than deleting everything automatically. Also remember that ClamAV is mainly useful for known signatures; it is not a complete guarantee that a Linux system is clean.