Malware

The scanner looks at the files of your websites, at the processes running on the server and at the integrity of the system. It never deletes or moves a file on its own: quarantine happens only when you ask for it.

What a scan checks#

• Signatures: 28 built-in patterns for web shells (C99, R57, WSO, B374K, China Chopper and others), backdoors, injected scripts, crypto miners and phishing kits.
• Known malware: the SHA-256 of each scanned PHP file is checked against InfraFence's database of known malware files. Only the hash is sent, never the file.
• YARA: web-relevant rules from YARA Forge, taken only from sources whose license allows commercial use: signature-base and ReversingLabs. The rules are refreshed once a day. They need the yara tool: Install YARA under Settings › Malware installs it with the server's package manager (apt-get, or dnf/yum with EPEL).
• Heuristics: PHP files with very high entropy (typical of obfuscated code), and PHP files created in the last 48 hours in upload and temporary directories.
• Frameworks: WordPress, Laravel, Django, Rails, Express and Node, Symfony, CakePHP, CodeIgniter, Joomla and Drupal are recognized, with configuration checks for each: debug mode in production, exposed or world-readable .env files, missing or default keys, PHP files in WordPress uploads, and similar.
• WordPress: core files compared with the official checksums of the installed version; the database checked for injected scripts in posts and options, and for administrators created in the last 7 days.
• Processes: running crypto miners, reverse shells, and PHP, Python or Perl scripts running from /tmp, /dev/shm or /var/tmp.
• System integrity: system binaries modified since their package was installed (dpkg -V or rpm -Va), and rootkit indicators such as /etc/ld.so.preload, hidden processes and executables that do not match their process.

Every finding says why it matched, its severity and the file's SHA-256, with the rule's source and author for YARA findings.

Schedules#

Under Settings › Malware: Automatic scans enabled (off by default) and Scan every 3, 6, 12 or 24 hours. Scan now starts a scan of one server at once.

With automatic scans on, the agent also watches upload directories (uploads, upload, tmp, temp, files, media, wp-content/uploads) every 30 seconds and scans any new or changed PHP file straight away.

Quarantine, ignore, restore#

On a finding:

• Quarantine file moves it to /var/lib/infrafence/quarantine/, read-only, with its original path, owner and permissions recorded. Only files inside a detected website can be quarantined.
• Ignore marks a false positive: later scans skip that file for that signature. Stop ignoring undoes it.
• A quarantined file can be restored. Restoring is always a person's decision, never AutoMode's: the file goes back to its original place with its owner and permissions, without the execute bit, and never over an existing file.

Uninstalling the agent leaves the quarantine directory in place, so nothing is lost.

Next to other scanners#

ImunifyAV, Imunify360 and Monarx scan files too. They work side by side: InfraFence never deletes or moves a file on its own. See Coexistence.