Hi Jonathan,
If you don't mind, I will like to ask for a new suggestion on CXS, there is a button that says QUARANTINE that when is clicked it brings you to another page that shows another link to VIEW QUARANTINE, I think is better to only have one button, so, why not change the QUARANTINE button at the top of the UI to go straight to VIEW QUARANTINE?

This will save us one step to see the...

Hi Chirpy,
thank you for the new Quarantine option on the UI, it helps a lot to clean accounts that have been compromised. It is really useful to use this new option on one account basis as using it on a cron check could give a lot of false positives.

But on the other hand, it will be great to have another option to automatically quarantine files reported containing a virus on an automatic cron...

Suggest an 'All Restore Option'.

Reason: Dummies like me click the quarantine box and it placed thousands of false-positive files into quarantine. An 'all restore option' just like the 'all delete option' would be a gratefully appreciated addition.

Thanks.
Ivan

Is there a way to adjust the cron function so that we can run either a certain amount of accounts each night, spread over a week, or a way to do usernames in a specific letter range rather than by selecting the usernames to go from and to?

the reason i ask is with servers constantly adding accounts what may have been the first account starting with the letter e may not be the case if that...

I would like if is possible to have a option to automatically suspend an account when detect exploits or regall argument. Something like to append to the scanner like /scripts/suspendacct .It doesn't matter if is a false positive. I can test for you the script with this option on my server if you want. It will help a lot. I had a user who tried to upload 900 times, can you imagine that?...

Hi,

I have a daily cron on each server running cxs, and it sends the report by email... but most days there will be 0 suspicious items, and there really isn't any need for me to receive a daily email report from every server running cxs when there is nothing found...

By adding the total number of suspicious items found to the email's Subject line, I can create a filter to automatically delete...

Hi folks,
Ok, we've found clients with the usual c99 shell scripts installed and the thought occurred to me below.

Could CXS be set to either append this text to existing .htaccess files or add an .htaccess file to directories where obvious shell scripts have been located?
Addhandler text/plain .pl .cgi .php .py .jsp .asp .shtml .sh

Or, maybe you folks have a different approach?

What we do...

Hi folks,
Ok, been using this wonderful tool for a while now.

I've bought five licenses already and hoping to purchase more, though the existing reporting format is quite daunting to review.

In a typical report of a server with lets say 300+ websites, the existing reporting format is not workable IMHO.

I recommend a basic summary be included at top.
If you would like to get fancy and sell...

It would be nice if cxs would tell csf to block an IP address after it tried to upload exploits to the server x number of times in y minutes. I see the --block option but based on the documentation, I assume the block would happen instantly? I am looking more for the same parameters used for other CSF configurations.

It will be nice that CXS could change directories from 777 to 775 on the fly, that will help to speed things up.

Of course, that option could be turned ON or OFF.

Regards,

Sergio

hi all,
when stopping ftp with /etc/rc.d/init.d/pure-uploadscript stop I sometimes see this error message:
==========================================================
Stopping pure-authd:
/etc/rc.d/init.d/pure-uploadscript: line 45: [: 25771: unary operator expected
==========================================================

this seems to be because there were more than one pure-ftpd processes...

I installed cxs over the weekend and it seems to work well.

I see the cPanel GUI for cxs allows scanning all accts alphabetically (optionally starting at a certain spot) and for a particular acct. It would be nice if we also had the option to specify all accounts of a particular reseller. This would be useful after migrating a new reseller to the server and running a scan on all new accounts....

I got things out of order and when I first installed it, I restarted FTP before starting /etc/init.d/pure-uploadscript, which crashed FTP until I figured out I had to have /etc/init.d/pure-uploadscript running first.

Noticed on a reboot, though, if /etc/init.d/pure-uploadscript crashes (which would crash FTP itself and cause checksrvd to restart pure-ftpd), there doesn't seem to be anything to...

Hello,
We are still tweaking but the script seems to be working well.

WE do have one request.
When setting it up to scan multiple users there is a start after,
for servers that have large numbers of sites a feature to have
start after and stop after so that scans can be run in blocks is awesome.....

One other feature ( unless we just havnt found it yet ) would be to allow a white list for...

When viewing a quarentine list for a client It would be awesome if the upload IP Address was a clickable link that went to somewhere like

and just append the IP address to the end

Just a quick thought since we actually backtrack the IP address

thanx

How about a front end function that can plugin to cPanel so that clients can scan their own directories, and or setup crons to get an email report on their own site

this would be a handy replacement for the clamav module that servers that dont have mailscanner installed can use...