ImunifyAV

ImunifyAV is a website antivirus.

Licenses

A free version of the module is available in the panel with the following functions:

• unlimited checks;
• detection of backdoors, web shells, spam scripts, trojans, misleading SEO, phishing pages and other malicious scripts;
• checking domains and server IP-addresses for sanctions and blacklists of Google, Yandex, Roskomnadzor and other organizations;
• support for all types of CMS written in PHP, including WordPress, Joomla!, Magento, Drupal, MODx, Bitrix, as well as static html-sites.

Limitations

 Not available in the current version of the ImunifyAV module:

•  curing and removing infected files; 
• scanning of archives.

Requirements

• Before installing the module, make sure that a public IP address is used on the server with the panel. ImunifyAV operation on a server behind NAT is not supported.
• The alternate version of PHP 7.1 allows the use of the putenv and passthru functions.
  Details

   To test operability of functions:

  1. Navigate to the PHP section.
  2. Select the alternative PHP 7.1 version→  Advanced settings.
  3. Select the disable_functions variable in the table → click Edit.
  4. Make sure that there are no putenv and passthru values for the variable in the Value field.

Installation

1. Authorize in the panel under an administrator level account or above.
2. Go to the Modules section.
3. Scroll down and find ImunifyAV (ex. Revisium) → click Install.
4. Wait for the installation to complete.

During the installation, the alternative version of PHP 7.1 and its extensions such as ioncube, posix, intl, json will be automatically installed. After installation, make sure that PHP settings meet the requirements.

Configuring the module

1.  Go to ImunifyAV →  Settings.
2. Select the desired options for scans: 
   • Quick-check — the antivirus will check only critical files with extensions ph*,htm*, js, txt, tpl to reduce server load and increase scanning speed. 
   • Skip media files — option is available when express check is disabled. Select the checkbox not to scan media files.
   • Optimize by speed — select the checkbox to scan files from cache folders selectively. It speeds up the scanning process with the same level of malware detection;
   • Malware detection banner — select the checkbox to show a banner in ispmanager panel when malware is detected;
   • Max concurrent threads — set the maximum number of concurrently running threads. Optimal value: half of the number of available server kernels.
   • Scheduled scanning —  set the interval of automatic website scanning. 
   • Max allowed memory per scanning — set the value of RAM usage per scanning thread.
   • Log level — specify the level of detail of messages registered in the log /usr/local/mgr5/var/raisp_data/log.
   • Max. scanning time for 1 site — set the optimal time after which the site scanning will stop. 
   • Check domain blacklisted status — select the checkbox if you want the antivirus to check if the site and server IP address are blacklisted.
   • Auto update antivirus databases — select the checkbox to keep the ImunifyAV bases up to date.  
3. Save the changes.

Scanning modes

Module has two scanning modes:

• By users — the selected user's directory and all sites in it are fully checked starting from /var/www/username/. Domain reputation is not checked.
• By domains — the entire web domain directory and the blacklist reputation of domains are checked. Files located outside domain directories are not checked.

To start the scanning process:

1. Authorize in the panel under an administrator level account or above. 
2. Go to the  ImunifyAV section.
3. Click Scan all to check for malicious entities across all domains or users.
   Or click Scan  to check by the selected domain or user.
   When malicious entities are detected, the status “Infected” is displayed for the infected domain or user.

Paid version

The paid version is installed independently, through the server console and is not available for customization in the web interface of the panel.