ClamAV and maldet

ClamAV and Linux Malware Detect (maldet) are free antivirus engines that know many existing infections: web shells, phishing kits and infected uploads. Qartvelo Guard can use them as a second opinion next to its own signatures. They are optional.

Where to see the status

Settings > Advanced > Antivirus engines shows whether each engine is installed, whether PHP may run it, what it is used for and the result of its self-test. The Dashboard has an "Antivirus engines" row, and step 6 of the setup wizard shows the same status.

The self-test

Before using ClamAV, the plugin asks every ClamAV program it finds to scan the harmless EICAR test file. The result is kept for 6 hours and refreshed in the background; Check again runs it at once. Uploads never wait for a test.

Whole-site scans only use the fast daemon client (clamdscan), and only for code, script and HTML files. The plugin refuses to turn ClamAV on while its self-test fails.

The cgav server script

cgav is a small script for root that installs and checks ClamAV and maldet on your server. Every command prints the status before and after, is safe to run again, and never deletes or moves site files. It needs a Debian or Ubuntu server (apt) or AlmaLinux, Rocky, CentOS or CloudLinux (dnf or yum), with systemd and curl.

Install it in one paste

In Settings > Advanced > Antivirus engines, open Install everything in one paste (as root) and copy the block. It already contains the whole script and your WordPress folder. It has this shape:

cat > /root/cgav.sh <<'CGAV_EOF'
#!/usr/bin/env bash
SITE="${SITE:-/var/www/example.com}"
# ... the rest of the script, as shown in the plugin ...
CGAV_EOF
bash /root/cgav.sh self-install /var/www/example.com
cgav status

Paste the block from the plugin, not this outline. Download server script (cgav) gives you the same script as a file. self-install copies it to /usr/local/bin/cgav and adds the site folder to its list of watched sites (/etc/cgav.sites).

Commands

A typical first run:

cgav install-clamav
cgav install-maldet
cgav test
cgav status

Then press Check again in the plugin and Turn on ClamAV for uploads.

Several sites on one server

On a server with several domains (for example CyberPanel or cPanel), one ClamAV and one maldet serve every site. Install them once, then add each WordPress site to the monitor; a site inside a folder that is already watched is covered by that watch, and the plugin counts it as watched. When a site is not watched, its Antivirus card shows the cgav add-site line to run:

cgav sites
cgav add-site /home/second-site.com/public_html
cgav add-all
cgav status
cgav scan all

maldet reads its list of folders (monitor_paths) only when the monitor starts. maldet --monitor reload re-reads its settings, not that list, so a new site needs a restart of the monitor. cgav add-site does that itself; by hand, add the folder to the list and restart:

echo /home/second-site.com/public_html >> /usr/local/maldetect/monitor_paths
systemctl restart maldet

Install ClamAV by hand

Ubuntu or Debian

sudo apt-get install -y clamav clamav-daemon
sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl enable --now clamav-freshclam
sudo systemctl enable --now clamav-daemon

AlmaLinux, Rocky, CentOS, RHEL or CloudLinux

Install clamav clamav-update clamd from EPEL, remove the "Example" line from the configuration files, set the LocalSocket, allow scanning under SELinux and start clamd@scan. The plugin's install guide shows every command for your server; cgav does all of it with cgav install-clamav.

Test it

curl -s -o /tmp/eicar.txt https://secure.eicar.org/eicar.com.txt
clamdscan --fdpass /tmp/eicar.txt
rm /tmp/eicar.txt

The last line of the scan should end with "FOUND".

When PHP may not use the clamd socket

Add the PHP user to the clamav group and restart PHP (or set LocalSocketMode 666 in clamd.conf and restart clamd):

sudo usermod -a -G clamav www-data

Panel notes

• cPanel: with root access, install ClamAV in WHM under cPanel > Manage Plugins. It lands in /usr/local/cpanel/3rdparty/bin, where the plugin looks for it. Start the service with /scripts/restartsrv_clamd. Without root, ask your host, or use cPanel's Virus Scanner or Imunify.
• DirectAdmin: da build set clamav yes, then da build clamav. If clamd starts without a database, run freshclam -v once.
• Plesk: its own ClamAV comes with Email Security and scans mail only. For uploads, install ClamAV from the system packages as root (cgav does this).
• CyberPanel: ClamAV is used for mail only; install it from the system packages for uploads.
• HestiaCP and VestaCP: ClamAV may already run for mail. Check with systemctl status clamav-daemon.
• GridPane: maldet and ClamAV are built in on larger plans; switch them on in the GridPane panel.
• Cloudways, Hostinger and managed WordPress hosts: there is no root access, so ClamAV cannot be installed. Use the host's own malware scanner.

maldet

The plugin does not run maldet itself. It shows whether maldet is installed, its signature version, whether its signatures are linked into ClamAV (then every ClamAV check uses them), and whether its real-time monitor watches your site. Keep maldet's own quarantine off (quarantine_hits="0" in /usr/local/maldetect/conf.maldet, which cgav sets), or both tools would move the same files.

The real-time monitor shows Unknown or Not running

On servers that mount /proc with hidepid, PHP cannot see processes of other users, so the root-owned monitor is invisible to the plugin. Since 1.0.1 the plugin then reads maldet's event_log, where the running monitor writes a line about every 30 seconds, and shows "Running (last activity N seconds ago)". When that log is not fresh either, it shows "Unknown" instead of a false "Not running". To check it yourself and to start the monitor, as root:

pgrep -af inotifywait
cgav monitor status
tail -n 5 /usr/local/maldetect/logs/event_log
cgav monitor start

maldet's logs use the server's time zone, which can differ from yours. More in Troubleshooting.