How to Scan Malware in AWS EC2 Instances

Malware is a type of software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system. It can take many forms, such as viruses, worms, ransomware, and trojans, and can be spread through various means, including email attachments, social media links, and online downloads.

How To Scan Malware via AWS Inspector

In Amazon Web Services (AWS), it is important to regularly scan your EC2 instances for malware to ensure that your system is secure and running optimally. Here’s how you can do it:

  1. Enable Amazon Inspector

Amazon Inspector is an automated security assessment service that can help you identify vulnerabilities and malware in your EC2 instances. To use it, you will first need to enable it in your AWS account. You can do this by going to the Amazon Inspector page in the AWS Management Console and following the instructions to set it up.

  1. Create a Target Group

Once you have enabled Amazon Inspector, you will need to create a target group to specify which EC2 instances you want to scan. You can do this by clicking on the “Create a target group” button on the Amazon Inspector page and following the prompts to specify the instances you want to include.

  1. Run an Assessment

Once you have created a target group, you can run an assessment to scan your EC2 instances for malware. To do this, click on the “Create an assessment” button on the Amazon Inspector page, select your target group, and follow the prompts to specify the assessment settings. You can choose to run the assessment on demand or schedule it to run at regular intervals.

  1. Review the Results

After the assessment has been completed, you can review the results to see if any malware was detected in your EC2 instances. The results will be available on the Amazon Inspector page, and you can click on any findings to view more details and get recommendations for how to fix them.

Scan Malware Using Clamav

This tutorial is supposed to run on Amazon Linux 2

Install EPEL

sudo amazon-linux-extras install epel

Install ClamAV

sudo yum install clamav clamd -y

Remove Example configurations

 sudo sed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf
sudo sed -i -e "s/^Example/#Example/" /etc/freshclam.conf

Update the Virus Definition Database

sudo freshclam

Open “scan.cnf” file for editing

sudo vi /etc/clamd.d/scan.conf

Un-comment the following line by removing #

#LocalSocket /var/run/clamd.scan/clamd.sock

Then run a VirusScan using the following command

clamscan  --quiet dirname/


By regularly scanning your EC2 instances for malware using Amazon Inspector, you can ensure that your system is secure and running optimally. This can help protect your data, improve system performance, and reduce the risk of security breaches.

Leave a Comment

Your email address will not be published. Required fields are marked *