You could run these commands on regular basis grep -R "document.write(unescape" * > js_malware.txt grep -iR --include ".php" "[a-zA-Z0-9\/\+]\{255,\}" > php_

You could run these commands on regular basis grep -R "document.write(unescape" * > js_malware.txt grep -iR --include ".php" "[a-zA-Z0-9\/\+]\{255,\}" > php_malware.txt Once the commands complete, examine the .txt files and see if any files are compromised.