[MC] Quarantine 1.0.3

Quarantine scans the files your members upload for viruses and malware, using ClamAV, VirusTotal or both. A file that passes is published as normal, with no visible delay for the uploader. A file an engine flags is hidden from everyone, moved out of the public attachment store and placed in the native approval queue, and the uploader is alerted. Releasing or deleting it is always a moderator's decision, and every scan is recorded so you can see exactly what happened to any file.



Features

Scanning engines

• ClamAV daemon (clamd): scans over a TCP or Unix socket during the upload request
• ClamAV binary (clamscan): no daemon needed, slower per file
• VirusTotal: 70+ engines, checked in the background so uploads are never kept waiting
• Run one engine or several together. A file is quarantined as soon as any of them flags it
• Fail mode per engine: when an engine errors, either let the upload through and retry later (fail open, the default) or hold it until a verdict arrives (fail closed)
• Identical files are scanned once: the SHA-256 is checked against earlier verdicts first, which saves VirusTotal quota. Clean ClamAV verdicts are reused for at most a day, so new signatures still reach older files
• VirusTotal quota is read from VirusTotal itself, and a full quota delays scans instead of failing them
• Files above 10 MB (default) are scanned in the background, and stay hidden from other members until the scan finishes
• Password-protected archives can be rejected outright, since nothing can scan inside them. Archive size, file count and nesting limits for clamscan

What gets scanned

• Attachments everywhere, including Resource Manager files and Media Gallery uploads
• Avatars, profile banners, Resource Manager icons and custom media thumbnails, which are rejected at upload when infected
• Add-on archives uploaded through the AdminCP installer
• Icons, covers and banners uploaded through other add-ons, through one shared check
• Attachments that other add-ons write without the usual upload step are picked up and scanned in the background
• Limit scanning by file extension or size

Quarantine and review

• Quarantined files are hidden from members, and their bytes and every thumbnail are moved to internal_data, so no direct URL reaches them. Releasing puts everything back
• Quarantined files appear in the native approval queue, with Release (mark clean) and Delete
• Quarantined attachments page with filters by engine, verdict, uploader, content type and date, an evidence drawer per file, and bulk release, rescan and delete
• The uploader gets an alert when a file is quarantined, released or deleted
• A later clean rescan never releases a file on its own, and every release or delete is written to the moderator log
• Admin notifications of quarantined files, sent straight away (at most every 15 minutes by default) or as a daily digest

Scan reports for members

• Each attachment shows its scan state (No threats found, Scan in progress or Threat detected), with a preview on hover and a link to the full report
• Members see the state, the scan date and how many engines checked the file
• Moderators also see each engine's verdict, the signature, the VirusTotal detection count and the SHA-256. Members never do, so an uploader cannot use the report to tune a file until it passes
• Resource Manager versions show their scan state on the resource page and in the version history
• Hover preview and badge placement are style properties, so each style can set its own

Per-forum policy

• Turn scanning off in a forum, or give it its own engines and fail mode, from the forum's own edit page

Repeat offenders

• Act on a member after a set number of infected uploads within a counting window (off by default, window 30 days)
• Report them to moderators, moderate their account or ban them. Administrators and moderators are never moderated or banned
• Counts are per file: rescans, several engines flagging one file and files a moderator released do not add up
• Repeat offenders page with the count and action for each member, and a reset

Monitoring and maintenance

• Overview page: scan state of every attachment, files awaiting review, recent activity, engine status and verdict reuse
• Scan log with every engine run and every error in the engine's own words
• Scan existing attachments in the background, with live progress on the overview
• EICAR self-test that proves each engine is reachable and its signatures load
• Hourly health check that emails admins when an engine stops answering, its virus definitions are more than 7 days old, its errors spike, or VirusTotal nears its quota
• Failed scans are retried after 6 hours, up to 5 times (defaults)
• Optional scan history retention that never deletes an infected verdict

Automation

• Native webhooks for quarantined, released, deleted and engine issue events, set up under Setup › Webhooks
• REST API with mcquarantine:read and mcquarantine:write scopes: list and read quarantined files and engine status, and release, delete or rescan
• mc-quarantine:scan command with exit codes for scripts: 0 clean, 1 error, 2 threat found
• Other add-ons can register their own scan engines

Permissions and options

• Manage quarantined attachments: administrators and moderators on install
• View attachments hidden by quarantine and Permanently delete quarantined attachments: given to every group that can manage quarantined attachments on install. Deleting is its own permission because it cannot be undone
• View virus scan reports: every group that can view the forum on install
• Bypass virus scanning on uploads and Exempt from VirusTotal: no group on install
• Hide attachments that have not been scanned: treat files with no verdict like pending ones, off by default
• Options are grouped into General, Response, ClamAV, VirusTotal and Advanced tabs

Other features

• Works with the Resource Manager and Media Gallery when they are installed, and does nothing for them when they are not
• Responsive on mobile, and works in light and dark styles

FAQ

Do I need ClamAV on my server?
No. VirusTotal works on its own with a free or paid API key. ClamAV needs either the clamd daemon or the clamscan binary on your server, and you can use both engines together.

What does it send to VirusTotal?
The SHA-256 of each file is looked up first. With Upload unrecognized files to VirusTotal on (the default), a file VirusTotal has never seen is uploaded to it for analysis. Turn that off and only hashes leave your server. Groups with Exempt from VirusTotal never have their files sent at all.

What happens to files uploaded before I installed it?
They stay visible and are marked as not scanned. Scan existing attachments on the overview checks them in the background, and Hide attachments that have not been scanned keeps them hidden until they have a verdict.

What happens if an engine goes down?
Each engine has its own fail mode. Fail open (the default) lets uploads through and retries them later. Fail closed holds them until the engine answers. The health check emails admins when an engine stops responding.

What happens when I uninstall it?
Quarantined files are moved back into the attachment store first, then every table and column the add-on added is removed. Those files become visible again, so release or delete them before uninstalling.

Is there branding, and can I remove it?
Yes, a small footer credit. Removing it is free: switch it off with the Remove branding option in [MC] Core Library.



Screenshots

Scanning engines


Quarantine and review





Scan reports for members








Per-forum policy


Repeat offenders


Monitoring and maintenance



Permissions and options