cPanel Virus Scanner: How to Scan and Clean Infected Files

Got an email from your host saying malware was found on your account, or noticed your site flagged in Google Safe Browsing? Before you panic and start deleting files, cPanel has a built-in tool made exactly for this: the Virus Scanner. Here's how to actually use it, read the results correctly, and clean up without breaking your site.

What the Virus Scanner Actually Is

Under cPanel → Advanced → Virus Scanner, most shared hosting accounts (including Getwebup's) ship with a ClamAV-based scanner you can run from the browser. No SSH, no root, no cron setup. It's a different tool from Imunify360's automatic quarantine (which reacts in real time and moves suspicious files on its own) and different from a VPS-level ClamAV install where you're running scans as root over an entire server. This one scans just your account — home directory, email, or public_html — on demand, and leaves the decision about what to do with a flagged file in your hands.

That distinction matters. If you're on a VPS and want automated, scheduled scanning across the whole box, you need a proper ClamAV + rkhunter setup at the OS level. The cPanel Virus Scanner is the shared-hosting equivalent: manual, account-scoped, and good enough to catch the common stuff — injected PHP backdoors, spam-sending scripts dropped by a compromised plugin, infected email attachments sitting in old mailboxes.

Symptom: Why You'd Reach for This Tool

• Your host's abuse team emailed about outbound spam or a malicious script found on your account.
• Browsers show a "Deceptive site ahead" or Google Safe Browsing warning for your domain.
• Your site is randomly redirecting visitors to spam or adult sites.
• A plugin or theme update failed and you suspect a nulled/pirated copy was the entry point.
• You just want a clean bill of health before a client handover or migration.

Running a Scan

1. Log in to cPanel and open Advanced → Virus Scanner.
2. Pick a scan target. You'll usually see options like Scan Home Directory, Scan Mail, Scan Public FTP Space, and Scan Entire Home Directory (Including Mail). For a suspected website compromise, scan the home directory; for spam complaints, scan mail as well.
3. Click Scan and let it run. On a large account (tens of thousands of files, big media library) this can take anywhere from a few minutes to over an hour — don't close the tab, but it's safe to open a new tab and keep working.
4. When it finishes, you'll get a results table: file path, and an action dropdown per file (usually Ignore, Quarantine, or Delete).

Reading the Results Without Overreacting

This is where people get into trouble. Not everything flagged is actually malicious, and not everything that's actually malicious gets flagged.

If you're not sure whether a flagged file is legitimate, don't delete it outright. Quarantine keeps a copy cPanel can restore from if you got it wrong, which is exactly why it's the safer default over Delete for anything you can't identify with certainty.

The Fix: Cleaning Up Properly

Running the scan is step one. A thorough cleanup looks like this:

1. Quarantine flagged files first, don't delete outright, until you've confirmed each one is actually malicious.
2. Change every password tied to the account — cPanel password, WordPress admin, database user, FTP/SFTP accounts, and email passwords if mail was also compromised. If one credential leaked, assume they all did.
3. Update everything — WordPress core, every plugin, every theme. Most infections ride in through an outdated plugin with a known vulnerability, not a zero-day.
4. Check for new admin users in WordPress (Users → All Users) and new cPanel/FTP accounts you didn't create.
5. Re-scan after cleanup to confirm nothing was missed, and check cron jobs (WHM/cPanel → Cron Jobs) for anything that looks unfamiliar — a common re-infection trick is a scheduled task that re-downloads the malware.
6. Review .htaccess in your document root and any uploads folders for injected rewrite rules or PHP handlers you didn't add.

If the scanner keeps finding the same files reappearing after you clean them, that's a sign the entry point is still open — usually an outdated plugin, a leaked FTP password, or a scheduled cron re-infecting the account. Cleaning symptoms without closing the entry point just means you're back here next week.

Prevention: Keeping It From Coming Back

• Keep WordPress core, plugins, and themes updated — set up auto-updates for minor releases at minimum.
• Avoid nulled/pirated plugin and theme copies; they're a common malware delivery method.
• Use strong, unique passwords for cPanel, database, and WordPress admin — a password manager makes this painless.
• Enable two-factor authentication on both cPanel and WordPress admin logins.
• Run a Virus Scanner pass monthly, or right after any plugin/theme install from a source you're not 100% sure about.
• Consider Imunify360 (if available on your plan) for real-time, automatic protection between manual scans — the two tools complement each other rather than overlap.

The Virus Scanner won't catch everything a full server-level security suite would, but for a shared hosting account it's a fast, no-cost first check that catches the vast majority of real-world infections. Run it before you assume the worst, and run it again after cleanup to confirm the fix actually held.