Antivirus

Antivirus is the classic, signature-based scanner: it runs ClamAV against your files, matching them against a database of known malware signatures, quarantines what it finds, and keeps its signatures fresh automatically. For hunting hacked PHP sites and web shells specifically, see the complementary Malware Scanner.

Scanning

Three scan types cover the ground: Quick scans user home directories, Full does a deep scan across the hosting and system data directories, and Custom scans a path you choose (system-critical directories are refused). Scans run as background jobs with live progress: percentage, files scanned, current file, and threats found, and a running scan is picked back up automatically if you reload the page. A threat found is moved to quarantine.

Real-time protection

A real-time protection toggle watches key directories (home, temp, web and cron areas) for newly created or changed files and scans them as they appear, catching a malicious upload the moment it lands rather than waiting for the next scheduled scan.

Quarantine and signatures

The Quarantine tab lists everything the scanner isolated, where you can restore a file (if it was a false positive) or delete it permanently. The Definitions tab shows the signature database (versions, signature count, size) and updates it: use the panel's Update Now button rather than running freshclam from a shell, so updates land where the daemon actually reads them. Automatic updates can run hourly, daily or weekly.

Access

Behind the clamav license feature (Pro and up) and, at the backend, ROOT and ADMIN. See roles and permissions. The ClamAV service itself runs regardless; the license gates the panel controls, not the protection.