HF PanelDocsv1.0.0

Malware

Set the server's malware policy, scan accounts, and review every account's findings, cleaned files and quarantine.

The Malware screen sets what the malware scan does on this server and shows what it found, cleaned and quarantined in every account.

Where: Server Admin › Security › Malware

Figures

Figure What it shows
Open findings findings not yet dealt with in every account, and the last scan's result (or the time a running scan started, UTC)
In quarantine files kept in quarantine, and after how many days they are deleted for good
When something is found the server policy's action and schedule

Set the server policy

Field What it does
When something is found Report only: findings are listed and emailed. Quarantine: new findings are moved to quarantine. Clean and quarantine: known injections are cleaned in place (the original is kept in quarantine) and everything else is quarantined.
Scan Daily (every night), Weekly (once in 7 days per account) or Off
Skip these paths (one per line, below web/) paths every account's scan ignores; * and ? match any characters
Keep quarantined files (days) 1–365, default 30. After that a quarantined file is deleted for good.
Customers may set their own policy customers then see the policy form on their Malware screen
Leave an empty PHP file in place of a quarantined .php file keeps a website working when it includes the quarantined file

Click Save. The change is written to the activity log.

What can be cleaned: PHP code put in front of a file's own code, added after its end, or put into its first line (the usual eval(base64_decode(…)) injections), and spam redirect rules in .htaccess. An infected WordPress core file is replaced by the clean copy of the same WordPress version, downloaded with wp-cli as the account. Whatever is left must pass every check, otherwise the file is quarantined instead.

Important: files a customer marked safe are never cleaned or quarantined automatically. Nothing is deleted automatically except quarantined files older than the days you set.

Accounts

The Accounts table lists every hosting account with its Open findings, files In quarantine, files Cleaned, Last scan and Policy (As the server, or its own).

  • Scan now scans one account in the background. Scan every account (top right) scans all of them.
  • Policy sets the account's own action, schedule and skipped paths. Leave a choice on As the server to follow the server policy. An account's skipped paths are added to the server's.

Findings and quarantine

Findings and Quarantine list what was found and kept in every account, with an Account column and the same buttons customers have: Clean, Quarantine, It's safe, Delete now and Put back (with Overwrite the file there now). See Malware for what each one does.

Quarantined files are kept in /var/lib/hostfog-quarantine/<account>/, readable by root only and outside every home folder, so a hacked account can neither change nor serve them, and they are not part of the account's own backups. Each copy keeps the original path, owner, permissions, modification time, SHA-256 checksum, the detection and when it happened.

Emails and events

  • New findings are emailed to the customer and to your support address.
  • Each Monday, customers whose websites had findings, cleaned or quarantined files in the last 7 days get a Weekly malware report, and you get one summary of all accounts. Nothing is sent in a week without any.
  • The events malware.found and malware.cleaned go to your webhooks and script hooks.