{"id":310,"date":"2026-09-29T10:06:14","date_gmt":"2026-09-29T17:06:14","guid":{"rendered":"https:\/\/hostandtech.com\/kb\/?p=310"},"modified":"2026-09-29T10:06:14","modified_gmt":"2026-09-29T17:06:14","slug":"scan-for-malware-cpanel-virus-scanner-imunifyav","status":"publish","type":"post","link":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/","title":{"rendered":"How to Scan for Malware in cPanel (Virus Scanner and ImunifyAV)"},"content":{"rendered":"<h2>Overview<\/h2>\n<p>To scan for malware in cPanel, open <strong>Virus Scanner<\/strong> in the <strong>Advanced<\/strong> section, choose <strong>Scan Public Web Space<\/strong> and click <strong>Scan Now<\/strong>. Infected files are listed when the scan finishes, and you can quarantine, delete or ignore each one. If your host has ImunifyAV installed, a second scanner appears in cPanel and catches many web shells and injected PHP the ClamAV scan can miss.<\/p>\n<p>This guide is for owners of WordPress and other PHP sites on cPanel hosting who suspect a hack: redirects to spam, unknown admin users, or a security warning from Google. You&#8217;ll run both scanners, check the places malware hides that scanners often skip, clean up safely and find out how it got in. Plan on 30 to 60 minutes for one site.<\/p>\n<h2>Prerequisites<\/h2>\n<ul>\n<li>cPanel login for the affected account.<\/li>\n<li>A fresh backup before you delete anything. See <a href=\"https:\/\/hostandtech.com\/kb\/wordpress\/how-to-backup-wordpress-site\/\">how to back up a WordPress site<\/a>.<\/li>\n<li>SSH access if available (optional but faster for the manual checks).<\/li>\n<\/ul>\n<h2>Step-by-Step: Scan for Malware in cPanel<\/h2>\n<h3>Step 1: Run the cPanel Virus Scanner<\/h3>\n<ol>\n<li>In cPanel, open <strong>Virus Scanner<\/strong> under <strong>Advanced<\/strong>. If the icon isn&#8217;t there, ClamAV isn&#8217;t installed on your server; skip to Step 2 or see the admin notes below.<\/li>\n<li>Under the scan options, choose <strong>Scan Public Web Space<\/strong> to check <code class=\"\" data-line=\"\">public_html<\/code>. The other options are <strong>Scan Mail<\/strong>, <strong>Scan Public FTP Space<\/strong> and <strong>Scan Entire Home Directory<\/strong>.<\/li>\n<li>Click <strong>Scan Now<\/strong>. A progress panel shows files scanned and the percentage complete; large sites can take several minutes.<\/li>\n<li>When it finishes, read the <strong>Infected Files<\/strong> list.<\/li>\n<\/ol>\n<figure class=\"wp-block-image\"><img src=\"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/09\/cpanel-virus-scanner-path.webp\" alt=\"Diagram of the cPanel path Advanced, Virus Scanner, Scan Public Web Space, Scan Now, then Infected Files\" width=\"1000\" height=\"820\" loading=\"lazy\" decoding=\"async\"><figcaption>The cPanel Virus Scanner steps from menu to results.<\/figcaption><\/figure>\n<p>Pick <strong>Quarantine<\/strong> for anything you&#8217;re unsure about. It moves the file into a folder in your home directory, so you can restore it if it turns out to be a false positive. Only choose the delete option once you&#8217;ve looked at what the file is. Start with Scan Public Web Space; scanning the entire home directory takes far longer and mostly re-reads mailboxes and backups.<\/p>\n<h3>Step 2: Run ImunifyAV if your host provides it<\/h3>\n<p>Where installed, <strong>ImunifyAV<\/strong> appears in the cPanel menu. Open it and start a scan of your home directory. The free ImunifyAV lists detected files and scan history but cannot clean them; automatic cleanup and scheduled background scans are part of the paid ImunifyAV+ and Imunify360. On the free tier you delete or replace infected files yourself, using the steps below. Two scanners with different signature sets find more than one does, so run both if you have them.<\/p>\n<h3>Step 3: Check the places scanners miss<\/h3>\n<p>Scanners work from known signatures. Freshly modified or obfuscated files can pass. These three checks over SSH take a minute:<\/p>\n<div class='ht-code-snippet'><button class='ht-code-snippet__copy' onclick='htCopyCode(\"code-block-1\")' type='button' aria-label='Copy code'><svg class='ht-copy-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z'><\/path><path d='M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z'><\/path><\/svg><svg class='ht-check-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M13,24l-9-9,1.414-1.414L13,21.171,26.586,7.586,28,9Z'><\/path><\/svg><\/button><span class='ht-code-snippet__feedback'>Copied to clipboard<\/span><\/p>\n<pre class='ht-code-snippet__code' id='code-block-1'><code class=\"\" data-line=\"\">find ~\/public_html\/wp-content\/uploads -type f -name &#039;*.php&#039;<\/code><\/pre>\n<\/div>\n<p>The uploads folder should hold images and documents only. Any PHP file there is almost certainly a backdoor.<\/p>\n<div class='ht-code-snippet'><button class='ht-code-snippet__copy' onclick='htCopyCode(\"code-block-2\")' type='button' aria-label='Copy code'><svg class='ht-copy-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z'><\/path><path d='M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z'><\/path><\/svg><svg class='ht-check-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M13,24l-9-9,1.414-1.414L13,21.171,26.586,7.586,28,9Z'><\/path><\/svg><\/button><span class='ht-code-snippet__feedback'>Copied to clipboard<\/span><\/p>\n<pre class='ht-code-snippet__code' id='code-block-2'><code class=\"\" data-line=\"\">find ~\/public_html -type f -name &#039;*.php&#039; -mtime -7<\/code><\/pre>\n<\/div>\n<p>This lists PHP files changed in the last week. On a site you haven&#8217;t updated recently, every result deserves a look. Then search for two patterns attackers use to hide code:<\/p>\n<div class='ht-code-snippet'><button class='ht-code-snippet__copy' onclick='htCopyCode(\"code-block-3\")' type='button' aria-label='Copy code'><svg class='ht-copy-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z'><\/path><path d='M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z'><\/path><\/svg><svg class='ht-check-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M13,24l-9-9,1.414-1.414L13,21.171,26.586,7.586,28,9Z'><\/path><\/svg><\/button><span class='ht-code-snippet__feedback'>Copied to clipboard<\/span><\/p>\n<pre class='ht-code-snippet__code' id='code-block-3'><code class=\"\" data-line=\"\">grep -rlF -e &#039;eval(base64_decode&#039; -e &#039;gzinflate(base64_decode&#039; ~\/public_html --include=&#039;*.php&#039;<\/code><\/pre>\n<\/div>\n<p>A few legitimate plugins use these functions, so open each match instead of deleting it blindly. For WordPress, compare core and plugin files against the official copies:<\/p>\n<div class='ht-code-snippet'><button class='ht-code-snippet__copy' onclick='htCopyCode(\"code-block-4\")' type='button' aria-label='Copy code'><svg class='ht-copy-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z'><\/path><path d='M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z'><\/path><\/svg><svg class='ht-check-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M13,24l-9-9,1.414-1.414L13,21.171,26.586,7.586,28,9Z'><\/path><\/svg><\/button><span class='ht-code-snippet__feedback'>Copied to clipboard<\/span><\/p>\n<pre class='ht-code-snippet__code' id='code-block-4'><code class=\"\" data-line=\"\">wp core verify-checksums\nwp plugin verify-checksums --all<\/code><\/pre>\n<\/div>\n<p>Any &#8220;checksum does not match&#8221; or &#8220;file should not exist&#8221; line is worth investigating.<\/p>\n<h3>Step 4: Clean up and close the door<\/h3>\n<ol>\n<li>Replace WordPress core and reinstall every plugin and theme from fresh downloads. Delete unused ones entirely.<\/li>\n<li>Change every password that touches the site: cPanel, FTP, database, WordPress admins and email. Remove admin users you don&#8217;t recognise. Turn on <a href=\"https:\/\/hostandtech.com\/kb\/security\/how-to-implement-two-factor-authentication\/\">two-factor authentication<\/a>.<\/li>\n<li>Check <strong>Cron Jobs<\/strong> and <strong>FTP Accounts<\/strong> in cPanel for entries you didn&#8217;t create.<\/li>\n<li>Run the scans again. A clean result on both is your baseline.<\/li>\n<\/ol>\n<p>Finding the entry point matters more than the cleanup. Outdated plugins, nulled themes and reused passwords cause most infections. Otherwise the malware is back within days. Turn on <a href=\"https:\/\/hostandtech.com\/kb\/cpanel\/how-to-enable-modsecurity-cpanel\/\">ModSecurity<\/a> if your plan allows it, follow the <a href=\"https:\/\/hostandtech.com\/kb\/wordpress\/how-to-secure-wordpress-site\/\">WordPress hardening guide<\/a>, and block abusive addresses with the <a href=\"https:\/\/hostandtech.com\/kb\/cpanel\/how-to-block-ip-address-cpanel\/\">IP Blocker<\/a>.<\/p>\n<h3>Step 5 (server owners): Install the scanners<\/h3>\n<p>On your own VPS or dedicated server with WHM, the cPanel Virus Scanner appears once you install the ClamAV plugin from <strong>WHM &gt; Plugins<\/strong> and the Exim mail service is present. For ImunifyAV, run the installer from the <a href=\"https:\/\/docs.imunify360.com\/imunifyav\/\">ImunifyAV documentation<\/a> as root, then enable the end-user page so cPanel accounts can see it:<\/p>\n<div class='ht-code-snippet'><button class='ht-code-snippet__copy' onclick='htCopyCode(\"code-block-5\")' type='button' aria-label='Copy code'><svg class='ht-copy-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z'><\/path><path d='M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z'><\/path><\/svg><svg class='ht-check-icon' viewBox='0 0 32 32' width='16' height='16' fill='currentColor'><path d='M13,24l-9-9,1.414-1.414L13,21.171,26.586,7.586,28,9Z'><\/path><\/svg><\/button><span class='ht-code-snippet__feedback'>Copied to clipboard<\/span><\/p>\n<pre class='ht-code-snippet__code' id='code-block-5'><code class=\"\" data-line=\"\">bash imav-deploy.sh\n\/usr\/share\/av-userside-plugin.sh<\/code><\/pre>\n<\/div>\n<p>Harden the rest of the server with our <a href=\"https:\/\/hostandtech.com\/kb\/security\/how-to-secure-your-linux-server\/\">Linux hardening guide<\/a> and the <a href=\"https:\/\/hostandtech.com\/kb\/security\/server-security-audit-checklist-2026\/\">security audit checklist<\/a>.<\/p>\n<h2>Common Issues &amp; Troubleshooting<\/h2>\n<h3>The Virus Scanner icon is missing in cPanel<\/h3>\n<p><strong>Cause:<\/strong> the server administrator hasn&#8217;t installed the ClamAV plugin for cPanel.<\/p>\n<p><strong>Fix:<\/strong> ask your host to enable it, use ImunifyAV if it&#8217;s offered, or rely on the manual checks in Step 3. On <a href=\"https:\/\/hostandtech.com\/cloudlinux-cpanel-shared-hosting\">Host &amp; Tech cPanel hosting<\/a>, contact the <a href=\"https:\/\/hostandtech.com\/help\">help centre<\/a> to ask what scanners are enabled for your account.<\/p>\n<h3>The scan stops or never finishes<\/h3>\n<p><strong>Cause:<\/strong> a very large home directory, or the account hit its resource limits during the scan.<\/p>\n<p><strong>Fix:<\/strong> scan Public Web Space only, then Mail separately. If the scan is killed, see <a href=\"https:\/\/hostandtech.com\/kb\/shared\/fix-508-resource-limit-is-reached-cpanel\/\">508 Resource Limit Is Reached<\/a>.<\/p>\n<h3>A legitimate file is flagged<\/h3>\n<p><strong>Cause:<\/strong> a false positive, common with obfuscated commercial plugin code.<\/p>\n<p><strong>Fix:<\/strong> quarantine it, confirm the plugin still works, and compare the file with the vendor&#8217;s download. If they match, restore it and choose to ignore it.<\/p>\n<h3>The malware comes back after cleaning<\/h3>\n<p><strong>Cause:<\/strong> the original way in is still open: an outdated plugin, a stolen password, or a backdoor in a file neither scanner flagged.<\/p>\n<p><strong>Fix:<\/strong> repeat Step 3 and Step 4 in full, and read your access logs from the time of the first infection. <a href=\"https:\/\/hostandtech.com\/kb\/security\/install-configure-fail2ban-ubuntu\/\">Fail2Ban<\/a> helps on servers you manage.<\/p>\n<div class=\"ht-faq-section\">\n<h2>Frequently Asked Questions<\/h2>\n<div class=\"ht-faq-item\">\n<h3 class=\"ht-faq-question\">Does cPanel have a built-in malware scanner?<\/h3>\n<div class=\"ht-faq-answer\">\n<p>Yes, if your host has installed it. The Virus Scanner in the Advanced section uses ClamAV to scan mail, your public web space, public FTP space or your whole home directory. Some hosts also offer ImunifyAV, which appears as a separate icon.<\/p>\n<\/div>\n<\/div>\n<div class=\"ht-faq-item\">\n<h3 class=\"ht-faq-question\">Is the cPanel Virus Scanner enough to clean a hacked site?<\/h3>\n<div class=\"ht-faq-answer\">\n<p>No. It finds many known infections but can miss new or obfuscated backdoors. Add manual checks such as PHP files in the uploads folder, replace core files and plugins from fresh copies, change all passwords, and find how the attacker got in.<\/p>\n<\/div>\n<\/div>\n<div class=\"ht-faq-item\">\n<h3 class=\"ht-faq-question\">What is the difference between ImunifyAV and ImunifyAV+?<\/h3>\n<div class=\"ht-faq-answer\">\n<p>ImunifyAV is free and scans and reports infected files. ImunifyAV+ adds automatic cleanup and scheduled background scans, and Imunify360 adds a full security suite on top. On the free version you remove infected files manually.<\/p>\n<\/div>\n<\/div>\n<div class=\"ht-faq-item\">\n<h3 class=\"ht-faq-question\">Should I delete infected files straight away?<\/h3>\n<div class=\"ht-faq-answer\">\n<p>Take a backup first, then quarantine instead of deleting. Quarantine keeps a copy you can restore if the file was a false positive, which matters for obfuscated but legitimate plugin code.<\/p>\n<\/div>\n<\/div>\n<div class=\"ht-faq-item\">\n<h3 class=\"ht-faq-question\">How often should I scan my hosting account for malware?<\/h3>\n<div class=\"ht-faq-answer\">\n<p>Weekly is sensible for a WordPress site, and always after a plugin vulnerability is announced or before you restore from a backup. If your host offers scheduled scans, turn them on so you don\u2019t depend on remembering.<\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Run the cPanel Virus Scanner and ImunifyAV, check the folders scanners miss, quarantine safely and find how the attacker got in, so the infection doesn&#8217;t come back next week.<\/p>\n","protected":false},"author":1,"featured_media":300,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[73],"tags":[40,263,220,82,339],"class_list":["post-310","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cpanel","tag-cpanel-security","tag-server-security","tag-website-security","tag-wordpress-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Scan for Malware in cPanel (ClamAV and ImunifyAV)<\/title>\n<meta name=\"description\" content=\"Scan for malware in cPanel with Virus Scanner and ImunifyAV, check uploads for hidden PHP, verify WordPress files, then clean up and close the way in.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Scan for Malware in cPanel (ClamAV and ImunifyAV)\" \/>\n<meta property=\"og:description\" content=\"Scan for malware in cPanel with Virus Scanner and ImunifyAV, check uploads for hidden PHP, verify WordPress files, then clean up and close the way in.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/\" \/>\n<meta property=\"og:site_name\" content=\"Host And Tech knowledge base\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/stshostandtech\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-29T17:06:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/09\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@stshostandtech\" \/>\n<meta name=\"twitter:site\" content=\"@stshostandtech\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#\\\/schema\\\/person\\\/b6fa79c48ddaba71af32e395c5b017ee\"},\"headline\":\"How to Scan for Malware in cPanel (Virus Scanner and ImunifyAV)\",\"datePublished\":\"2026-09-29T17:06:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/\"},\"wordCount\":1190,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp\",\"keywords\":[\"cPanel\",\"cPanel security\",\"server security\",\"website security\",\"WordPress security\"],\"articleSection\":[\"Server Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/\",\"url\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/\",\"name\":\"How to Scan for Malware in cPanel (ClamAV and ImunifyAV)\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp\",\"datePublished\":\"2026-09-29T17:06:14+00:00\",\"description\":\"Scan for malware in cPanel with Virus Scanner and ImunifyAV, check uploads for hidden PHP, verify WordPress files, then clean up and close the way in.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/#primaryimage\",\"url\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp\",\"contentUrl\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp\",\"width\":1200,\"height\":630,\"caption\":\"Title card: scan for malware in cPanel with Virus Scanner and a check for PHP files in uploads\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/security\\\/scan-for-malware-cpanel-virus-scanner-imunifyav\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Scan for Malware in cPanel (Virus Scanner and ImunifyAV)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#website\",\"url\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/\",\"name\":\"Host And Tech knowledge base\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#organization\",\"name\":\"Host And Tech knowledge base\",\"url\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/logo-dark.png\",\"contentUrl\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/logo-dark.png\",\"width\":1134,\"height\":395,\"caption\":\"Host And Tech knowledge base\"},\"image\":{\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/stshostandtech\",\"https:\\\/\\\/x.com\\\/stshostandtech\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/#\\\/schema\\\/person\\\/b6fa79c48ddaba71af32e395c5b017ee\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/aa1edac8bbadb442e059a5b65ad45a3b2e3ce689202373b96e3e567517ae4b39?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/aa1edac8bbadb442e059a5b65ad45a3b2e3ce689202373b96e3e567517ae4b39?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/aa1edac8bbadb442e059a5b65ad45a3b2e3ce689202373b96e3e567517ae4b39?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\\\/\\\/hostandtech.com\\\/kb\"],\"url\":\"https:\\\/\\\/hostandtech.com\\\/kb\\\/author\\\/admin_fjj7qydm\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Scan for Malware in cPanel (ClamAV and ImunifyAV)","description":"Scan for malware in cPanel with Virus Scanner and ImunifyAV, check uploads for hidden PHP, verify WordPress files, then clean up and close the way in.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/","og_locale":"en_US","og_type":"article","og_title":"How to Scan for Malware in cPanel (ClamAV and ImunifyAV)","og_description":"Scan for malware in cPanel with Virus Scanner and ImunifyAV, check uploads for hidden PHP, verify WordPress files, then clean up and close the way in.","og_url":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/","og_site_name":"Host And Tech knowledge base","article_publisher":"https:\/\/www.facebook.com\/stshostandtech","article_published_time":"2026-09-29T17:06:14+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/09\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp","type":"image\/webp"}],"author":"admin","twitter_card":"summary_large_image","twitter_creator":"@stshostandtech","twitter_site":"@stshostandtech","twitter_misc":{"Written by":"admin","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/#article","isPartOf":{"@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/"},"author":{"name":"admin","@id":"https:\/\/hostandtech.com\/kb\/#\/schema\/person\/b6fa79c48ddaba71af32e395c5b017ee"},"headline":"How to Scan for Malware in cPanel (Virus Scanner and ImunifyAV)","datePublished":"2026-09-29T17:06:14+00:00","mainEntityOfPage":{"@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/"},"wordCount":1190,"commentCount":0,"publisher":{"@id":"https:\/\/hostandtech.com\/kb\/#organization"},"image":{"@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/#primaryimage"},"thumbnailUrl":"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/09\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp","keywords":["cPanel","cPanel security","server security","website security","WordPress security"],"articleSection":["Server Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/","url":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/","name":"How to Scan for Malware in cPanel (ClamAV and ImunifyAV)","isPartOf":{"@id":"https:\/\/hostandtech.com\/kb\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/#primaryimage"},"image":{"@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/#primaryimage"},"thumbnailUrl":"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/09\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp","datePublished":"2026-09-29T17:06:14+00:00","description":"Scan for malware in cPanel with Virus Scanner and ImunifyAV, check uploads for hidden PHP, verify WordPress files, then clean up and close the way in.","breadcrumb":{"@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/#primaryimage","url":"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/09\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp","contentUrl":"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/09\/scan-for-malware-cpanel-virus-scanner-imunifyav.webp","width":1200,"height":630,"caption":"Title card: scan for malware in cPanel with Virus Scanner and a check for PHP files in uploads"},{"@type":"BreadcrumbList","@id":"https:\/\/hostandtech.com\/kb\/security\/scan-for-malware-cpanel-virus-scanner-imunifyav\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostandtech.com\/kb\/"},{"@type":"ListItem","position":2,"name":"How to Scan for Malware in cPanel (Virus Scanner and ImunifyAV)"}]},{"@type":"WebSite","@id":"https:\/\/hostandtech.com\/kb\/#website","url":"https:\/\/hostandtech.com\/kb\/","name":"Host And Tech knowledge base","description":"","publisher":{"@id":"https:\/\/hostandtech.com\/kb\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostandtech.com\/kb\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/hostandtech.com\/kb\/#organization","name":"Host And Tech knowledge base","url":"https:\/\/hostandtech.com\/kb\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostandtech.com\/kb\/#\/schema\/logo\/image\/","url":"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/05\/logo-dark.png","contentUrl":"https:\/\/hostandtech.com\/kb\/wp-content\/uploads\/2026\/05\/logo-dark.png","width":1134,"height":395,"caption":"Host And Tech knowledge base"},"image":{"@id":"https:\/\/hostandtech.com\/kb\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/stshostandtech","https:\/\/x.com\/stshostandtech"]},{"@type":"Person","@id":"https:\/\/hostandtech.com\/kb\/#\/schema\/person\/b6fa79c48ddaba71af32e395c5b017ee","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/aa1edac8bbadb442e059a5b65ad45a3b2e3ce689202373b96e3e567517ae4b39?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/aa1edac8bbadb442e059a5b65ad45a3b2e3ce689202373b96e3e567517ae4b39?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/aa1edac8bbadb442e059a5b65ad45a3b2e3ce689202373b96e3e567517ae4b39?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/hostandtech.com\/kb"],"url":"https:\/\/hostandtech.com\/kb\/author\/admin_fjj7qydm\/"}]}},"_links":{"self":[{"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/posts\/310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/comments?post=310"}],"version-history":[{"count":1,"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/posts\/310\/revisions"}],"predecessor-version":[{"id":315,"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/posts\/310\/revisions\/315"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/media\/300"}],"wp:attachment":[{"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/media?parent=310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/categories?post=310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostandtech.com\/kb\/wp-json\/wp\/v2\/tags?post=310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}