@MicheleB
In your (recent) posts, you talk about ClamAV and also (implicitly) provide a reason to NOT use ClamAV.
Of the 24 files allegedly to be infected, 15 files are (logrotated) log files!
These genuine log files are not malicious and/or do not contain malicious code, they only contain (harmless) patterns that ClamAV is acting upon (and creating false positives).
In short, do NOT delete them, just ignore them!
That answers questions 1 and 2, as formulated by you in the last post.
The notifications created by ClamAV with respect to mail related directories can be a bit more severe: it is indicating that you do not have a proper virus scanner in place.
Again, ClamAV has proven itself to be not the right tool for the purpose of blocking and neutralizing bad mail
before entering your systems.
In essence, virus scanners for mail related purposes and virus scanners for files and directories are a completely different thing.
The golden rule should be that virus scanners for mail related purposes should
intercept malicious mail
before entering the system, whereas virus scanners for files and directories should
detect malicious
code that is on the system.
Another golden rule is that a virus scanner for files and directories is a bit "odd": you should have everything in place to
prevent that bad code enters the system and for that purposes, the combination of ModSecurity, Fail2Ban, a (properly configured and strict) firewall AND a
virus scanner for mail purposes should
at least be present!
Stated differently: when having configured your system properly, there should be no need for a virus scanner for files and directories.
Now, let's return to some (concrete) answers for your questions 3 and 4.
Plesk Premium Antivirus (which is actually drWeb + some other goodies, nicely integrated into Plesk) is
highly recommended: it might be costly, but it works like a charm.
Plesk Premium Antivirus will, certainly when combined with proper DNSBL like zen.spamhause.org, be a proper solution that
- prevents specific mails from entering the system: malicious mail is being rejected, primarily due to zen.spamhause.org based blocking
- quarantines malicious mail, if it passes all security measures taken: the mail is rendered effectively harmless and is being put in a quarantaine dock
and that solution will give you a decent
automated protection against bad mails, with that protection including the required neutralization of malicious code in mails.
However, you should always keep in mind that the before mentioned solution is a solution "in the case that something happens", while the golden rule is that one should try to "prevent that any bad case scenario will occur": you should always keep track of mail and other logs and simply ban offending IPs permanently via a firewall.
In conclusion: yes! Plesk Premium Antivirus can help, but always keep in mind that you have to update the firewall to disallow offending traffic completely.
Hope the above helps a bit.
Regards........
Facebook
Twitter
