Drives a ClamAV installation on the server: daemon control, signature updates, on-demand and scheduled scans, and quarantine.

ClamAV must already be installed on the machine — the plugin detects this with clamscan --version and refuses to act otherwise. Because ClamAV's services are not in the agent's service allowlist, start, stop and restart are issued as fixed shell verbs through the root agent, and signature refresh stops clamav-freshclam, runs freshclam, and starts it again. Scans prefer clamdscan --fdpass --multiscan when the daemon is up and fall back to a standalone clamscan when it is down, so scanning stays available either way. A scan can also be launched detached, streaming per-file output into a job log that the UI polls for a genuine progress bar; the file total for the denominator is a best-effort find count, so very large trees may show an indeterminate bar.

Scheduled scans write a managed drop-in to /etc/cron.d that runs a management command as the panel user on a daily or weekly slot, covering either every website root or a custom list of absolute paths, with folder-name exclusions. Results are kept as a short history and, when something is found, raised as a panel notification to admins and optionally emailed — clean runs stay silent. Quarantine moves infected files into a root-owned directory and is admin-only, as are the daemon controls, signature updates, scheduling and the EICAR self-test. Non-admin website owners may scan and poll progress, but only inside document roots they actually own.

Real-time protection is optional: on-access scanning runs clamonacc over the website folders (/home/<user>/web, where FTP accounts also live) through a managed block in clamd.conf, never blocking access — a hit is alerted, or moved to the quarantine in quarantine mode. Incoming mail can be scanned by writing Rspamd's local.d/antivirus.conf when the Mail Server plugin is installed. Both need the daemon running (about 1.5 GB of RAM).

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Free — no key needed

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.0.5 — New icon in the shared flat style. 1.0.4 — New Real-time tab: on-access scanning (clamonacc) of the website folders (/home/<user>/web, which also holds what is uploaded over FTP) plus any extra folders, in alert-only or quarantine mode; access is never blocked, detections raise an alert and quarantined files can be restored. Warns when memory is short (the daemon needs about 1.5 GB). Incoming mail scanning through Rspamd's antivirus module when the Mail Server plugin is installed (reject, or accept and mark). 1.0.3 — New Quarantine tab: list quarantined files with where they came from, restore one to its original path (original owner and permissions; never overwrites, only into account homes, /var/www or a website root), delete one or all. Original paths are recorded for files quarantined from now on. Threat notifications also reach the admin's email/Telegram/webhook alert channels on panel 1.3.78+; the per-schedule email option is unchanged. 1.0.2 — Security: a website owner's scan is confined to their own home; a symlink in a site could list another account's files. 1.0.1 — "Signatures" shows the real number of loaded signatures (about 3.6 million) instead of the daily database version number. Initial release — daemon control, signature updates, on-demand file/directory scanning.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/clamav/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "clamav",
  "version": "1.0.5",
  "download_url": "..."
}