Virus scanners for Linux look for *Windows* viruses. The logic is that your windows server is acting as a file-storage location for users who are running Windows, and therefore scanning for Windows viruses will help protect your users. 

Protecting the Linux server isn't the goal. Viruses aren't the attack vector for servers.

**The *concept* of a virus implies a user at an interactive session.** Someone opening email in Outlook or documents in Word, or running programs they received in an email. A virus implies a human element. Servers don't (or shouldn't) have a reading email and browsing websites. Instead, attacks against servers are fully automated; no human required. They call that a "worm" rather than a "virus". 

Worms *are* a concern on Linux. **But protecting your server from that type of threat works differently.** Protecting users from viruses requires something stopping users from doing things they shouldn't. (Hence the "anti-virus"). protecting servers from worms and similar exploits involves fixing vulnerable software. If something is exploitable on your server, then the thing needs to be fixed.

In other words, you don't watch inbound files checking to see if any will hurt you if you run them, **because you *never* run them**. If you *do* run code delivered to you by someone on the Internet, then **that** is your problem. To fix the problem, you remove or fix the thing that's behaving dangerously.

So, for example, a vulnerable Wordpress plugin on Linux is vaguely analogous to a vulnerable Microsoft Office installation on Windows. On the Windows desktop, you carefully examine all inbound Microsoft Office documents checking to see if any will exploit the vulnerability in Office. But on the Linux server, you just remove or patch your Wordpress plugin and be done with it. Instead of keeping an antivirus up-to-date, you're supposed to keep your *server* up-to-date.

# And on the other hand, yes.

Now, it turns out that there is something called a [Web Application Firewall][1], which is surprisingly similar to the antivirus concept, but applied to websites instead of humans.

A WAF is built on the idea of protecting vulnerable sites from exploit much the same way as an antivirus tries to protect vulnerable desktops. It even uses roughly the same technique (looking for and blocking certain patterns). But while *all* antivirus products err heavily on the side of avoiding false-positives, a WAF can be configured to be so permissive as to be useless, or so restrictive as to break your site. 

Your particular installation should be very carefully tailored to match your given website. It takes work, and time, and lots of patience. But there should be a local maximum that gives you reasonable protection against the vulnerabilities you don't know are there while still maintaining a working site.

Though be warned, the more websites you have on a given server, the more difficult it becomes to tune your security configuration. On general-purpose shared-hosting servers, this type of solution is all but completely unworkable because of the false-positive rate. In other words, YMMV.


  [1]: https://www.owasp.org/index.php/Web_Application_Firewall