Malware Scanner

Premium plugin (addon malware-scanner). It scans the files of hosting accounts against 51 malware signatures, lets you quarantine what it finds, scans every account once a day and e-mails you about critical finds. It is the first thing to switch on for a server that hosts WordPress and other popular scripts, because that is where web shells come from.

What it looks for

The signature list is in the Host Manager, on the same page. Each entry has an id, a name, a severity and where it looks.

• 29 critical: encoded or request-driven code that runs, such as eval(base64_decode(...)), eval(gzinflate(...)), eval or assert of $_GET, $_POST or $_REQUEST data, system and shell_exec of request data, known web shells (c99, r57, WSO, b374k, FilesMan), the wp-vcd WordPress malware, .htaccess rules that run images as PHP, set auto_prepend_file or redirect search visitors, reverse shells, crypto miners, PHP code inside an image, cron entries that pipe a download into a shell, and the EICAR test file.
• 19 warnings: suspicious but sometimes legitimate: obfuscated strings, packed or fromCharCode JavaScript, hidden iframes, mail sent to request recipients, a catch-all redirect, files with names like a shell or a double extension, hidden PHP files, and PHP files inside an uploads folder.
• 3 notes: a file that only prints phpinfo(), an upload form, and hidden pharma or casino link spam.

It matches the contents of files (PHP, web files, scripts, images, text and .htaccess), the names of known shell files, paths (a PHP file in wp-content/uploads), and the cron entries of the account. It reads the first 512 KB of each file and skips files over 5 MB, mail folders, logs, node_modules, .git and its own quarantine.

For the host

Security Center → Malware Scanner in the Host Manager.

1. Choose All accounts or one account and press Scan Now. The result line reads Scanned 12 account(s), 41872 file(s): 3 finding(s), 3 new. A scan stops for an account that takes longer than the time limit and says so.
2. Review the table. Three tabs: To review, Quarantined and Ignore list, each with a count. Each row has the account, the path, the signature, the severity, the date found and buttons.
3. Quarantine moves the file to ~/.quarantine in the account's home with a small note file, so nothing is lost. Restore puts it back. Ignore adds the finding to the ignore list so it is not reported again, for a false positive.
4. Quarantine all critical files does this for every critical finding at once, after a confirmation.

A cron entry cannot be quarantined; remove it on the account's Cron Jobs page.

The signature table at the bottom shows exactly what is checked.

The daily scan

The cron (job plugins) starts the scan once every 24 hours for every active account. New findings are e-mailed. Critical files are only quarantined automatically if you turn that on, and it is off by default, so you look first.

For the customer

Security → Malware Scanner in the hosting panel, if the feature list allows it (malwarescanner). The page scans the account's home and shows the same three tabs with Scan Now, Quarantine all critical, and per row Quarantine, Restore and Ignore. The customer sees only their own files.

Settings

Plugins → Manage Plugins → Malware Scanner → Settings:

After a find

1. Do not just delete the file. Quarantine it, so you can inspect it.
2. Find how it got in: an old plugin or script, a stolen password, or a weak file permission. Update the script and change the account's passwords (hosting panel, FTP, databases).
3. Look for more: scan again, check Files → File Manager for files you do not recognise, and look at Cron Jobs.
4. If the account keeps getting infected, suspend it while you clean it up, under Account Functions → Manage Account Suspension.

The scanner finds known patterns. It is not an antivirus engine, and a clean scan is not a promise. Keep scripts updated and use the Security Advisor and the Firewall Manager as well.