malmon is a realtime backdoor/exploit detection and removal daemon. It uses inotify (pyinotify) to monitor file activity in one or more directories and checks files smaller than a size specified in configuration file. It's appropriate for hosting servers.