Install ClamAV

ClamAV requires root access to install and may be installed via either root WHM or through SSH if you do not have cPanel installed on your server. This article covers the following topics:

• Install ClamAV via WHM (Recommended)
• Configure ClamAV via WHM
• Install ClamAV via SSH
• Running ClamAV on a Cron Job
• Resolving Issues Identified by ClamAV

Install ClamAV via WHM (Recommended)

To install ClamAV via root WHM:

1. Login to root WHM.
2. Click Manage Plugins in the left-hand menu.
3. Locate Clam AV and select Install and keep updated.
4. Click the Save button to complete the installation.

Once installed, ClamAV will keep up to date with a daily cron job that automatically updates ClamAV.

Configure ClamAV via WHM

After ClamAV has been installed on your server, you may configure which items are scanned daily for all accounts, as well as configuring which items may or not be scanned for individual users or groups of users.

By default, ClamAV is set to scan all items daily.

To configure which items are scanned for all accounts during the daily scan:

• Log into root WHM.
• Click Configure ClamAV Scanner from the left hand menu.
• In the Scans Allowed Globally section, place a check next to any item you would like scanned:
  • Scan Entire Home Directory: This option will scan the entire home directory for each user.
  • Scan Mail: This option will specifically ensure that the mail directory is scanned.
  • Scan Public FTP Space: This option will specifically ensure that the public_ftp directory is scanned.
  • Scan Public Web Space: This option will specifically ensure that the public_html and www directories are scanned.
• Click the Save button to store your changes

To create user specific settings for a group of users in ClamAV:

• Log into root WHM.
• Click Configure ClamAV Scanner from the left hand menu.
• Click the User Configuration button in the ClamAV Scanner User Configuration section.
• Select a user you would like to configure separately from the Global settings and click the Add button.
• Repeat the previous step for all users which you would like to be separate from the Global settings.
• Select the desired Defaults, then click the Save Defaults button.
• You may click the [ Go Back ] link to return to the previous menu.

To update settings for a specific single user:

• Log into root WHM.
• Click Configure ClamAV Scanner from the left hand menu.
• Click the User Configuration button in the ClamAV Scanner User Configuration section.
• Enter the desired username in the Configure User text box in the User Scanner Configuration section.
• Click the Configure button.
• Select the desired settings, then click Save Defaults button.
• You may click the [ Go Back ] link to return to the previous menu.

Install ClamAV via SSH

Installing ClamAV via SSH is not recommended as we do not support the configuration of ClamAV via SSH. However, if you do wish to install ClamAV and do not have cPanel installed, it can be installed via SSH.

To install ClamAV via SSH:

• SSH into your server as root.
• Ensure that the EPEL repo is both installed and enabled by running the following command:
  yum install epel-release -y
• Install ClamAV with required ClamAV packages with the following command:
  yum install clamav clamd
• Run the following 3 commands to start the clamd service and set it to auto-start:
  /etc/init.d/clamd on
  chkconfig clamd on
  /etc/init.d/clamd start
• Update ClamAV's signatures with the following command:
   /usr/local/cpanel/3rdparty/bin/freshclam

Once installed and updated, ClamAV will update automatically as part of the /etc/cron.daily/freshclam cron job.

Running ClamAV on a Cron Job

One way to use ClamAV on a server with lower specifications than are recommended is to run it on a cron job in order to control the times and frequency of its scans.

The following article will provide information about running cron jobs on cPanel, which will allow you to manage when ClamAV is run:

• How Do I Create and Delete a Cron Job?

Resolving Issues Identified by ClamAV

If ClamAV discovers an issue, it may indicate that your server is compromised. If you have a compromised server, the following article will provide options for how to resolve any malicious software on your system:

• Getting Help with Hacked Accounts