Websites getting malicious code injected into them happens far more often than people think, especially WordPress sites running themes and plugins downloaded from unclear sources. Attackers usually do not break the site straight away. They leave a web shell sitting quietly, to be used later.
ImunifyAV is a server-side malware scanner that works with DirectAdmin, cPanel and Plesk. The basic edition is free.
What ImunifyAV does
ImunifyAV Free detects malicious files: backdoors, web shells, viruses, hacker tools, black hat SEO scripts and phishing pages. It reports, it does not clean.
ImunifyAV+ is the paid edition and adds one-click automatic cleanup. Its real value is that it can strip malicious code injected into the middle of a legitimate file while keeping the file intact, instead of deleting the whole file and breaking the site. The vendor claims an automatic cleanup success rate above 97%.
For most situations the free edition covers the thing that matters most: knowing whether you are infected at all.
Installing it
SSH into the server as root and run two commands:
wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh
bash imav-deploy.shThe install takes a few minutes. Once it finishes, log back into DirectAdmin and you will find ImunifyAV in the admin area.
Letting end users see their own scan history
By default only the server admin sees results. To let each site owner view scans for their own account, run:
/opt/alt/python35/share/imunify360/scripts/av-userside-plugin.shIf that path does not exist, the bundled Python version is probably different. Find it with:
find /opt/alt -name "av-userside-plugin.sh" 2>/dev/nullChecking the install
systemctl status imunify-antivirus
imunify-antivirus versionRun a test scan on one directory to confirm everything works:
imunify-antivirus malware on-demand start --path /home/username/domainsThen check the results:
imunify-antivirus malware on-demand status
imunify-antivirus malware malicious listThings worth knowing
False positives are normal. PHP files with packed or obfuscated code, common in commercial themes and plugins that protect against copying, get flagged as suspicious all the time. Do not delete on sight, check first.
Scanning is resource hungry. On a server with many accounts, schedule scans for off-peak hours rather than letting them run in the middle of the day.
Detection is not prevention. ImunifyAV tells you that you were compromised, but by then it has already happened. The things that matter more: keep core code and plugins updated, never use nulled themes or plugins, set correct file permissions, and keep backups somewhere separate from the server.
Finding malware means finding the way in. Deleting a malicious file without patching the hole that let the attacker in means they come back in a few days. Check the access logs around the time the malicious file was created to trace the cause.
