Scan files with cPanel's Virus Scanner

Virus Scanner uses ClamAV to look for content it recognises as malicious. Its availability depends on the server. It is a scanning tool, not confirmation that the whole account is safe.

Start a scan

1. Go to cPanel > Advanced > Virus Scanner, if it is enabled.
2. Choose the available scope: email, home directory or web space, depending on the screen. Check which directories it includes before you start.
3. Start the scan and wait for the result. Keep the paths and detection names together with the time of the scan.
4. Identify each file before applying the action offered. It may be legitimate content, a dangerous attachment or part of a wider intrusion.

The cPanel documentation describes the scopes and actions. Not all features are enabled on every service.

If it finds a threat

Keep a protected copy and the report before making changes. If you need to set a file aside, do it in a recoverable way outside public access. Renaming a PHP file inside the website or moving it to another public folder does not guarantee that it stops running.

Do not exclude a file just to make the warning go away. If you do not recognise the detection or it affects production, contact us with the path and the detection name before deleting it.

If it finds nothing

The result is limited to the content and signatures scanned. It does not necessarily check users, scheduled tasks, databases or the way in. If there are redirects or unauthorised changes, continue the investigation of the account even if the scan is clean.