Skip to main content

Question about email "A malware has been detected - Action Required"

Elizabeta
Hello, I have got an email "A malware has been detected - Action Required..."
Dear Administrator, We want to make sure that you are aware of any security threat that your server is exposed to. With this message we are letting you know that a malware was found on your server(s):
  • ******o[.]com
    • Location: hXXp://*****[.]com/ (main page of the website)
Leaving malware files untreated puts your entire environment at risk and creates significant security threats. We urge you to take action immediately. " Option 1: Please make sure that server administrator(s) take appropriate actions to Option 2: Upgrade from ImunifyAV to support team. Faithfully, Your Imunify360 Security Team Imunify->Scan All Users Result is No malware found. What this means? Should I do anything on server with user for which the email came although the scan result is "No malware found" Best regards, Elizabeta

Comments

36 comments

Date Votes
  • Elizabeta
    Hello, One more question, my ImunifyAV is version 6.6.3-1,whether it is possible to set the default action to clean infected files? Now in Settings for ImunifyAV 6.6.3-1 I do not see that there is such possibility. Best regards, Elizabeta
    0
  • rbairwell
    WordPress released )
    0
  • Elizabeta
    Hello, Thank you very much for your answer. Does this mean that one of my users has some problem even though Imunify after can result is "No malware found"..? Or is everything just ok with my user (no malwares), everything is related to the latest version of WordPress? It is recommended to install then WordPress Toolkit? WordPress Toolkit | cPanel & WHM Documentation Best regards, Elizabeta
    0
  • rbairwell
    I just noticed that your notification was slightly different from the one I received " Vulnerabilities found on your Server - Action Required: WordPress .... We are reaching out to you to keep you informed on security threats. The list below shows vulnerable software that has been detected in your environment: " (I'm on cPanel 7.9.2009/imunifyAV 6.6.3-1) However, since the scan is coming up clean, I'm reasonably confident that the site is okay, but feel free to check it via third party services such as Sucuri or Google Safe Browsing . It's worth while to ensure WordPress is always as up to date as possible and the WordPress Toolkit included for free in cPanel/WHM does make things a lot easier. ImunifyAV+ does have the ability to cleanup malicious files ( see ImunifyAV: Best Free Linux Server Antivirus ), but the free version included with cPanel (ImunifyAV) does NOT. To upgrade, follow the links in WHM's ImunifyAV panel. It'll give you the chance to buy Imunify360 for $45/pm to cover unlimited sites : however, it's only $25/pm for up to 30 users ($12 for single user) from Imunify directly (the unlimited price is the same). ImunifyAV+ is $6/pm per server (and whilst it looks like it can be order from within WHM, it doesn't work - so you'll have go to the
    0
  • cPRex Jurassic Moderator
    Thanks @rbairwell !
    0
  • Elizabeta
    Hello, Thank you @rbairwell for your answer. How can I update wordpress via whm? I do not any dashboard with wordpress. BR
    0
  • cPRex Jurassic Moderator
    You can use WordPress Toolkit at the WHM level to perform updates to each of the installs on your server.
    0
  • jigster
    I am getting exactly the same issue as the OP, same warning about one particular site then "No malware found" when I run a scan. What's annoying is that the email doesn't state anywhere what or where the 'detected malware' is. Not very useful and is just causing concern and extra work trying to figure out why this warning has been triggered. Cpanel folk, could you elaborate on what could be causing this warning? Thanks
    0
  • cPRex Jurassic Moderator
    @jigster - is the warning email from Imunify?
    0
  • jigster
    It's sent from cpanel (cpanel@hostname.com), but the email is signed "Your Imunify360 Security Team". At the bottom it says "Imunify::Generic" notifications are currently configured to have an importance of "High" so I guess it's part of cpanel's notifications. The email is exactly the same as the one posted by the OP.
    0
  • cPRex Jurassic Moderator
    @jigster - thanks for the additional details. If you update WordPress do you continue to see those notifications?
    0
  • jigster
    It's not a wordpress site. Wordpress has never even been installed on the account/domain.
    0
  • cPRex Jurassic Moderator
    Can you please submit a ticket to our team so we can take a look?
    0
  • stormy
    I'm having a similar problem. Malware is being reported on a site that doesn't have any malware (nor a WordPress install). Plus, the Imunify notifications don't appear in Contact Manager.
    0
  • jigster
    After submitting a ticket to cPanel, the issue was the website simply had a reference to a domain which they considered suspicious (in this case just an example domain listed on the site). That caused the malware warning email, but doesn't show up on a malware scan. Confusing if you ask me - the email should give details of the what triggered the warning.
    0
  • cPRex Jurassic Moderator
    @jigster - was our team able to create an improvement case based on your experience?
    0
  • jigster
    @cPRex - not that I know of, no
    0
  • cPRex Jurassic Moderator
    Could you get me that ticket number so I can read up on this a bit more?
    0
  • jigster
    Sure - ticket Id #94504749
    0
  • cPRex Jurassic Moderator
    It looks like this actually was escalated to CloudLinux because it was an Imunify issue and they replied with this: This is to let you know that we have heard from the malware analysts team, and it's been advised that absolute-email.net was flagged due to the blacklisted domain yourbusiness.com being present in the dummy text on the site, as per the screenshot below:
    so that seems like a good resolution. Is that not what you expected? I don't see a reply after that on the ticket, so I'm wondering if you didn't receive that.
    0
  • stormy
    If I may chime in, how come these emails mention that they can be turned off in WHM's Contact Manager, but they're nowhere to be found?
    0
  • cPRex Jurassic Moderator
    @stormy - you're not wrong, it doesn't exist there at all! There's been a bit of back and forth on where that notification should be adjusted as Imunify updates the plugin for WHM. Currently, you can adjust it directly in WHM >> ImunifyAV. I've let our team know about this through an internal case and I'll be sure to report back if I here more details.
    0
  • stormy
    Thanks @cPRex but I don't see that option. I don't have the paid version of Imunify, and the free one doesn't have any email notification settings.
    0
  • jigster
    @cPRex Thanks for the update, yes I did see the reply I just completely forgot to reply to the ticket! I was happy with the answer I received, I was just commenting that the warning email that is received should state what the problem is because it is very disconcerting to receive a notice that malware is on your website, then when you do a scan it shows there is no malware. In this case some dummy text on the website is not what I would consider malware, so I worried over nothing.
    0
  • cPRex Jurassic Moderator
    @stormy - near the top right, you'll want to click the gear wheel: Then you'll see the notifications area:
    0
  • stormy
    Yes, but there's no email notifications in the notifications area. Not on the regular Imunify, that's a Imunify360 feature. All I have available there is the possibility of running a script.
    0
  • cPRex Jurassic Moderator
    It's just not very clear - all of those options are email notifications.
    0
  • stormy
    No they are not! I can't enable or disable anything. And there's nothing related to the notification that we are talking about.
    0
  • cPRex Jurassic Moderator
    Can you make a ticket with our team?
    0
  • stormy
    @cPRex I think you are mistaking the versions. Imunify360 does have email fields in that same screen, as described here:
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post