problem with uploading an eicar test file on the server

Bessalah

• March 23, 2018 12:41

Hi, I got a server with centos 7, Cpanel and WordPress CMS installed on it. I installed an antivirus provided with Cpanel (ClamAV). When I try to upload an Eicar file with a virus signature to test the server, the file is identified and it is not uploaded on the server (it's good). If I do the same thing with WordPress media library the file is uploaded (the eicar virus signature is not detected). Is it a way to fix it? Attached a screenshots of uploading eicar file on Cpanel and WordPress library Thanks in advance.

• 

  rpvw

  • March 23, 2018 17:49

  I don't think clamav automatically scans for any file upload or download in any other protocol other than exim or file manager You could try using FTP or your Wordpress to upload the file, and then initiate a clamav scan via the cPanel clamav interface for that domain. Maybe something like

  0
• 

  cPanelMichael

  • March 23, 2018 17:53

  Hello, The previous post is correct. The automatic scanning for viruses automatically occurs with File Manager when you install ClamAV. However, that same functionality does not apply to your PHP scripts. You'd need to see if there are any WordPress plugins that do what you are seeking, or consider setting up regular scans of your website files with the clamscan utility located at: /usr/local/cpanel/3rdparty/bin/clamscan Thank you.

  0
• 

  fuzzylogic

  • March 23, 2018 23:01

  I suggest you investigate Configserver Exploit Scanner (CXS). It is a paid third party WHM Plugin that does an excellent job at upload scanning. (As well as other good things) It uses a modsecurity rule to intercept HTTP uploads for scanning. Once intercepted it checks uploads against ClamAV signatures(which would hit your eicar test file uploaded by WordPress), CXS's own signatures and scans them with regex for malicious or high risk strings. After using CXS for a few years, I wouldn't run a cPanel server without it. note: I have no affiliation with Configserver (but do have good will towards them)

  0

Please sign in to leave a comment.