Jordan
The smart scan in cPFence targets only commonly infected file types, making it quicker and less resource-intensive. On the other hand, the full scan thoroughly examines all files on the server.
If cPFence is installed and no initial smart or full scan is conducted, it won’t be aware of pre-existing infected files, as it only monitors newly added, changed, or modified files. That’s why we strongly recommend running an initial scan to catch any potential threats already present.
To address resource usage, yes, the scan is throttled by our cPFence Owl module, which ensures that system resources are efficiently managed to prevent excessive strain during scans.
Regarding the database hash updates, since cPFence utilizes the ClamAV scanner, it continuously updates its virus database. You can see the number of known viruses reported by the system, which changes hourly. This is because our database is regularly updated with new hashed signatures from reputable malware databases, along with new signatures from malware scripts we discover or receive through submissions at https://submit.cpfence.app/.
Additionally, we also update YARA rules and generic rules, although these updates happen much less frequently than virus signature updates.
So, you can simply run a test scan now and you will see results similar to this:
----------- SCAN SUMMARY -----------
Known viruses: 9570684
Engine version: 1.0.7
Scanned directories: 1
Scanned files: 1
Infected files: 0
Data scanned: 0.73 MB
Data read: 0.35 MB (ratio 2.08:1)
Time: 36.916 sec (0 m 36 s)
Start Date: 2024:10:23 22:29:36
End Date: 2024:10:23 22:30:13
Wait one hour and run the scan again, and you’ll likely see something like this:
----------- SCAN SUMMARY -----------
Known viruses: 9571834
Engine version: 1.0.7
Scanned directories: 1
Scanned files: 1
Infected files: 0
Data scanned: 0.73 MB
Data read: 0.35 MB (ratio 2.08:1)
Time: 36.057 sec (0 m 36 s)
You can observe the number of known viruses changing every single hour. Sometimes it goes up, and sometimes it goes down when we optimize more generic rules or remove outdated absolute signatures. This helps us strike the perfect balance between keeping the database small and effective, it's the sweet spot we are always aiming for.
