In short
Most malware arrives by email in an attachment or a download link: documents with macros, password-protected archives, disk images, or shortcuts. A signature-based antivirus catches known threats, but not new variants. That's why multi-engine scanning gets combined with sandbox analysis: the suspicious attachment is opened in an isolated environment and its behavior is observed before delivery.
The most-used formats
| Format | How it's used |
|---|---|
| Office documents with macros | The document asks you to "enable content" to run code. Microsoft blocks macros from internet-downloaded files by default, so attackers look for other formats. |
| Password-protected ZIP or RAR | The password sits in the email body. The filter can't open the file to scan it. |
| ISO, IMG and VHD | Disk images that open with a double-click and can contain executables or shortcuts. |
| Shortcuts (.lnk) | They look like documents, but run commands when opened. |
| HTML | Rebuild the malware in the browser. See HTML smuggling. |
| Rarely carry malware directly; more commonly a link or a QR code to a download or a fake page. |
Why signature-based antivirus isn't enough
A signature-based antivirus, like ClamAV (which can be turned on in cPanel), compares every file against a database of known malware. It's useful and worth keeping on, but attackers constantly generate new variants, encrypt files, or password-protect them so they can't be scanned.
What sandbox analysis is
A sandbox is an isolated environment, similar to a real computer, where the suspicious attachment is opened to observe its behavior: whether it tries to download other files, connect to unknown servers, modify the system, or encrypt documents.
Because it judges what the file does rather than how it looks, it catches variants that no signature knows about yet.
Best practices
- Turn on ClamAV in WHM as a baseline.
- Be wary of password-protected archives that arrive without being requested.
- Don't enable macros in documents that arrive by email.
- Keep the operating system, browser and Office up to date.
- Add a layer that combines multiple engines with a sandbox. Clisec scans files and links with multiple engines before delivery, and runs suspicious attachments in an isolated environment to observe their behavior.
Frequently asked questions
Is ClamAV enough for a cPanel server?
It's a good baseline against known malware, but it doesn't detect new variants and can't scan encrypted files. It's worth complementing.
Does the sandbox delay email delivery?
It's only used on suspicious attachments, which get held while they're analyzed. The rest of the email is delivered normally.
Why do attackers use password-protected ZIPs?
Because no filter can open them without the password. That's why an encrypted attachment that arrives unrequested is already a warning sign.
Protect every account on your server
Clisec scans files and links with multiple engines and runs suspicious attachments through a sandbox, across every account on your cPanel server.