mendozal
The full scan runs once a week at 2 AM and never uses more than one CPU core. Seeing 100 % CPU just means one core is busy, not the whole system. It also runs with nice and ionice to stay lightweight, so even on a small VPS with 4 cores and 4 GB RAM, it won’t cause performance issues.
If you still want to disable it (not recommended), set ROOTKIT_DAILY=off. That also turns off the weekly scan, though you can still set up a custom rootkit scan later with a cron job if needed.
