Antimalware v1.0.0

Unicorn Antimalware is based on Linux Malware Detect (LMD) and ClamAV.

Just shipped the first release of the antimalware role. Every site now has a Malware sub-page with one-click scans, live progress, and per-finding actions.

What it does

• Two engines in one pass - LMD 2.0.1 for hosting-tuned web-shell / dropper detection (sha256 + hex + YARA), followed by ClamAV 1.4.6 for general Linux/Windows malware, PDF exploits, macro viruses.
• Live progress bar - 5-phase pips (Warm up → Enumerate → LMD → ClamAV → Done) with per-second checkpoint updates. See what the scanner is doing, not just a spinner.
• Streaming findings - detections appear in the panel the moment either engine flags them, not just at end-of-scan.
• Per-finding actions - Quarantine (moves to .upcp/antimalware/quarantine/), Whitelist (marks false-positive, persists across rescans), Delete, and Restore.

Under the hood

• Ephemeral container design. No 24/7 daemon = no idle attack surface, no permanent RSS on the server. This design is expensive for larger servers which can handle more RAM. Next versions will accommodate this with more features.
• Runs --network=none --read-only --cap-drop=all during scans. Tenant filesystem mounted read-only. Signature volumes shared across scan runs so updates persist.
• Daily signature - update cron pulls fresh ClamAV + LMD sigs into a shared volume; scan containers just read from it.

Enabling it

Install the Antimalware role on any server. The Malware tab appears automatically for sites on that server. The very first sigupdate run takes about 10 minutes so Antimalware is not available immediately; subsequent updates are fast.

Coming next (1.0.1)

Per-site scan history export, and possibly quarantine expiry / auto-cleanup.

Feature ideas and repro reports welcome in this thread.