Antimalware

The Antimalware section scans your sites' files for malware, web shells and modified WordPress files. It is in the menu for administrators, resellers and users; everyone sees only their own sites. Nothing is ever deleted automatically: you decide what to do with each finding.

How it works

Each scan uses two engines together:

• Built-in scanner: fast and dependency-free, it recognizes the techniques backdoors use most: obfuscated code run with eval, commands taken from the web request ($_POST, $_GET…), functions chosen by the browser, preg_replace with the /e modifier, PHP code hidden inside images, PHP files in the uploads folder, .htaccess auto-execution, cron jobs that download and run code, and the names of common web shells (c99, r57, wso, alfa…). Since 0.85.0 it also recognizes redirects to other sites of visitors coming from search engines (SEO spam) and images run as PHP in .htaccess files, includes of files whose name is hidden in hex characters, small upload scripts used to drop web shells, WordPress administrators created in the code with the password written in it, obfuscated JavaScript loading more code (also in .js and .html files) and the most common spam mailers. The rules are deliberately conservative to limit false positives.
• ClamAV (signature antivirus): recognizes known malware. It is installed by panel-agent setup antimalware (called by install.sh and upgrade.sh). Because ClamAV's daemon keeps about 1–1.5 GB of signatures in memory, the panel picks the mode from the server RAM: resident daemon with at least 4 GB, on demand (signatures loaded only during a scan, no resident daemon) on smaller servers such as the 2 GB ones, and no ClamAV below ~1.5 GB — there the built-in scanner and the WordPress checks still work. You can force the mode in Settings. With the daemon running, scans go through clamdscan, which is much faster; if it is missing, the panel installs it on its own at the first scan.

If the site is WordPress, the panel also checks integrity: it compares the core and plugin files with the official ones from wordpress.org.

Since 0.85.0, also:

• Original files are not flagged. When a file is byte for byte the one published on wordpress.org (WordPress, a plugin or a theme of the official directory), the heuristic rules do not flag it: a security plugin that holds the names of web shells as a list of signatures is no longer an alarm. ClamAV signatures always count, because an official package can be compromised too.
• The database is checked too. The panel looks for obfuscated scripts in posts and pages and for code hidden in the settings (widgets, themes, plugins). It checks that the site address (home and siteurl) does not point to another domain and flags the new administrators that appeared since the last check: at the first check it takes note of the existing ones. The check only reads and uses WordPress's own connection, without reading the database password.

The new rules apply to the files that change and, for all the others, to the weekly full scan.

Every finding has a severity (critical, high, medium, low), a plain explanation, advice on what to do, the file path, the line and a snippet of the suspicious code (sanitized and shortened).

Scans run as low-priority background jobs (nice/ionice) as the site user, so they do not slow the site down. They are incremental: after the first full scan only new or changed files are re-checked (by date, size and hash), with a full scan once a week. Since 0.83.1 every scan also re-checks the files with an open finding: if the updated rules no longer confirm it, the finding closes by itself. At night the panel scans the sites in turn, one at a time. From 0.81.2 every scan runs in a memory group apart from the panel (a quarter of the RAM, at least 1 GB) and the list of the checked files stays on disk: even a site with millions of files can no longer slow down or stop the panel. If a scan goes over its memory, only the scan stops, with an error on the site's page.

Scan history

The History tab of the Antimalware page lists the scans of all your sites over the last 1, 7, 30 or 60 days: when, the site, the type (incremental or full, nightly or started by hand and by whom), the files checked and how many were new or changed, whether ClamAV ran (if not, why), the new and open findings, the duration and the result. Only the ones with problems keeps the failed scans, the ones where ClamAV gave an error and the ones with new findings. The page of every site has its own history at the bottom. The last 60 scans of every site are kept, about two months of nights.

What you can do with a finding

• Quarantine: the file is moved to a hidden folder out of the site (no longer reachable from the web) and made unreadable. It is reversible: Restore puts it back with its original permissions. The move is safe against symlinks and hard links.
• Delete: permanently removes a file already in quarantine (with confirmation).
• False positive: the finding is not shown again until the file changes (the list is by content hash, not just the path).
• Repair WordPress: puts the official core files back (after an automatic safety copy). wp-content and wp-config.php are never touched.
• Put the original back (since 0.85.0): for a file of WordPress, of a plugin or of a theme of wordpress.org, the panel downloads the official package of the installed version, checks that the file matches the published checksums and puts it in place of the flagged one. The previous file goes into the quarantine: Put the previous file back restores it, Delete the previous file removes it. For plugins that are not on wordpress.org the panel says so and touches nothing.
• False positive in every site (administrators, since 0.85.0): the same file, recognized by its hash, is no longer flagged in any site of the server. It is handy for a library used by many sites. The list is on the Antimalware page, under False positives of the whole server: if you remove an entry, the file is flagged again. Only an administrator can reopen these findings.
• Several findings at once (since 0.85.0): pick the findings with the boxes on the left, or Select all, and apply Quarantine, Put the originals back or Mark as false positives in one go. At the end the panel says how many succeeded and why the others did not.

In Settings (administrators) you can turn on nightly scans and choose their time window, the ClamAV mode, email alerts for new critical and high threats, and — if you want — automatic quarantine of «critical» threats only (not recommended unless you are comfortable with false positives).

Besides the scans, real-time protection checks every file as it is written.