PremiumComes with the add-on reqad-imunifyav. Installing add-ons

Malware scanner (ImunifyAV)

The malware scanner add-on puts CloudLinux's free ImunifyAV on the server and gives it a page in the panel. It scans the home folders of your hosting accounts for web shells, backdoors, injected code and other malware, on a schedule or when you ask, and lists every infected file with the account it belongs to.

What the free version does

ImunifyAV finds infected files and tells you where they are. It does not clean or delete them: that is up to you, in the file manager or over SSH. Automatic cleanup is part of ImunifyAV+, a paid licence from CloudLinux, which this page does not offer yet.

Installing ImunifyAV

Install the add-on, open Settings > Malware scanner and press Install ImunifyAV. The installer's output shows as it runs; it takes a few minutes. From the command line, reqad imav install does the same.

Reqad sets ImunifyAV up for this server before it starts:

• It scans the home folders of the hosting accounts, and knows which account and sites each folder belongs to. Reqad gives it the list of accounts and sites every 15 minutes, and straight away when an account, addon domain or subdomain is added or removed.
• It does not install its own WordPress plugin into your sites. That setting is locked, so an ImunifyAV update cannot turn it back on.
• It does not send the files it finds to CloudLinux for analysis. You can change that under Settings.

Scanning

• Scan all accounts, at the top of the page, queues a scan of every account.
• In the Accounts list, tick accounts and press Scan the ticked accounts. The list shows each account's infected files and its last scan.
• In the WordPress Toolkit, Scan on a site scans that site's folder only.

Scans run one at a time; the others wait in a queue. While one runs, the page shows its folder and how far it is, and Stop the scan stops it. Recent scans lists the scans that ran, with the number of files, what they found and how long they took.

Infected files

Infected files lists each file with its account, its path, the signature that matched and when it was found. Click an account, or its number of infected files in the Accounts list, to see only its files.

• Delete the infected file or replace it with a clean copy, then scan the account again to check nothing else is left.
• Ignore: later scans leave the ticked files out. Use it for a file you checked and know is safe, such as a security tool's test file.
• Remove from list: takes the ticked files off the list. A later scan lists them again if they are still infected.
• Ignored files lists what you ignored; Stop ignoring brings a file back into the scans.

Every account with infected files also gets a critical item in Needs attention on the dashboard, which opens the list for that account. Another item warns when the ImunifyAV service is not running, so no scans run.

Settings

Command line

reqad imav status                  # installed, running, version
reqad imav scan                    # every account
reqad imav scan <account> ...      # the accounts named
reqad imav scans --limit=10        # recent scans
reqad imav stop [--all]            # --all: the waiting scans too
reqad imav found [--account=<account>]
reqad imav install
reqad imav uninstall --yes
reqad imav sync                    # send the list of accounts now

Where things are

Removing it

Remove ImunifyAV at the bottom of the page (or reqad imav uninstall --yes) removes ImunifyAV and keeps its scan history and settings on the server, for a later install. The add-on stays, with its Install button.

Remove ImunifyAV first, then the add-on with dnf remove reqad-imunifyav. Removing only the add-on leaves ImunifyAV running without the list of accounts; the command prints how to remove it then.

Need a hand? Create a free account or contact us.