Suspicious "clam" process on Debian 10

by vooxo   Last Updated October 10, 2019 00:00 AM

Using sudo htop I'm seeing 2 unusual processes named clamd on my Debian 10 VPS. Unusual because I don't remember installing ClamAV and they take 20% of my 4GB memory (htop screenshot below): htop-screenshot

Recently I have installed mailcow-dockerized but I don't think there's clamd between active containers.

I tried to kill -9 it by PID, it's gone for 15-30 seconds, and then it comes back, consuming 20% of memory again.

Could this be a malware and how can I check it?


Related Questions

Updated March 23, 2017 04:00 AM

Updated February 26, 2016 04:00 AM

Updated April 22, 2017 13:00 PM

Updated October 24, 2015 13:00 PM

Updated July 13, 2018 00:00 AM