From 90e0c4a8f60f69de16ea9f794e84025265f7caa2 Mon Sep 17 00:00:00 2001
From: cschantz <admin@server.local>
Date: Mon, 22 Dec 2025 19:25:38 -0500
Subject: [PATCH] Fix ImunifyAV completion detection - use COMPLETED field not
 STATUS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous fix was close but used the wrong field to detect completion.

Issue: ImunifyAV uses "stopped" as the SCAN_STATUS even for successful scans.
The COMPLETED field (field 1) contains the completion timestamp.

Changed detection from:
- if SCAN_STATUS in (completed|stopped|failed)  ← Wrong, always "stopped"

To:
- if COMPLETED field has timestamp > 0  ← Correct indicator

This is the proper way to detect when an ImunifyAV scan finishes.
Now 99% confident this will work correctly.
---
 modules/security/malware-scanner.sh | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index 2624704..daaf8c6 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -848,25 +848,18 @@ for scanner in "${AVAILABLE_SCANNERS[@]}"; do
                         scan_info=$(imunify-antivirus malware on-demand list 2>/dev/null | tail -n +2 | head -1)
 
                         if [ -n "$scan_info" ]; then
-                            current_files=$(echo "$scan_info" | awk '{print $11}')
+                            completed_time=$(echo "$scan_info" | awk '{print $1}')  # Field 1 is COMPLETED timestamp
+                            created_time=$(echo "$scan_info" | awk '{print $2}')    # Field 2 is CREATED
+                            current_files=$(echo "$scan_info" | awk '{print $11}')  # Field 11 is TOTAL
                             current_status=$(echo "$scan_info" | awk '{print $7}')  # Field 7 is SCAN_STATUS
-                            created_time=$(echo "$scan_info" | awk '{print $2}')  # Field 2 is CREATED
 
-                            # Check if this is our scan (created after scan start)
+                            # Check if this is our scan (created after we started)
                             if [ "$created_time" -ge "$SCAN_START" ]; then
-                                # Check status
-                                if [[ "$current_status" =~ ^(completed|stopped|failed)$ ]]; then
+                                # Check if scan is complete (COMPLETED field has timestamp)
+                                if [ -n "$completed_time" ] && [ "$completed_time" != "COMPLETED" ] && [ "$completed_time" -gt 0 ]; then
                                     scan_running=false
                                     echo ""  # New line after progress
-
-                                    if [ "$current_status" = "failed" ]; then
-                                        log_message "ERROR: ImunifyAV scan failed for $path"
-                                        echo "  ✗ Scan failed for $path"
-                                        continue 2
-                                    elif [ "$current_status" = "stopped" ]; then
-                                        log_message "WARNING: ImunifyAV scan was stopped for $path"
-                                        echo "  ⚠️  Scan was stopped (may be incomplete)"
-                                    fi
+                                    log_message "ImunifyAV scan finished for $path (status: $current_status)"
                                     break
                                 fi
 
@@ -874,8 +867,8 @@ for scanner in "${AVAILABLE_SCANNERS[@]}"; do
                                 if [[ "$current_files" =~ ^[0-9]+$ ]]; then
                                     if [ "$current_files" != "$last_count" ]; then
                                         elapsed=$(($(date +%s) - SCAN_START))
-                                        printf "\r  Files scanned: %s | Elapsed: %s | Status: %s  " \
-                                            "$current_files" "$(format_time $elapsed)" "$current_status"
+                                        printf "\r  Files scanned: %s | Elapsed: %s  " \
+                                            "$current_files" "$(format_time $elapsed)"
                                         last_count=$current_files
                                         timeout_counter=0
                                     fi