Malware Scanner & Cleanup

Imunify360 scans all hosted files for malware and can automatically clean infections without deleting legitimate content.

Running a scan

Full server scan

1. WHM → Imunify360 → Malware Scanner
2. Click Scan → All
3. Click Start Scan
4. Large servers take 30-60 minutes. Progress shows in real time.

Single account scan

1. Malware Scanner → Scan → User
2. Enter the cPanel username
3. Click Start Scan

From SSH

# Scan a specific user
imunify360-agent malware malicious list --user=cpanelusername

# Scan a specific path
imunify360-agent malware on-demand start --path=/home/username/public_html

Understanding scan results

Results appear in Malware Scanner → Infected Files. Each entry shows:

Column	What it means
File path	Full path to the infected file
Account	Which cPanel account owns it
Detected	Type of malware (web shell, backdoor, injected code, etc.)
Status	Infected / Cleaned / Quarantined
Action	What you can do

Cleaning infected files

Automatic cleanup (recommended first step)

Select infected files → click Cleanup. Imunify360 surgically removes the malicious code while preserving the clean content of the file. A PHP file with injected malware becomes a clean PHP file.

Quarantine

If cleanup fails or the entire file is malicious, select → Quarantine. The file moves to a sandbox where it cannot execute. The website continues working normally: the file just can’t run.

To review quarantined files: Malware Scanner → Quarantine.

To restore a quarantined file (if it was a false positive): find it in the quarantine list → Restore.

Delete

Use for files that are entirely malicious with no legitimate content (pure web shells, pure backdoors). Select → Delete. This is permanent.

Common malware types

Type	What it does
PHP web shell	Gives attacker remote command execution via HTTP
Backdoor	Hidden access point that survives password changes
Injected redirect	Sends visitors to spam or phishing sites
Spam mailer	Sends bulk email using your server IP
Cryptominer	Uses server CPU to mine cryptocurrency
SEO spam	Injects hidden links to boost attacker-controlled sites

After cleaning: prevent reinfection

Cleaning the malware stops immediate damage but doesn’t close the vulnerability that allowed it in:

Update everything: WordPress core, all plugins, and themes. Most infections exploit known vulnerabilities in outdated software.

Change all passwords: WordPress admin, FTP, cPanel, and database passwords. Attackers often cache credentials.

Audit user accounts: look for unexpected admin users in WordPress (Users → All Users) and unexpected cPanel accounts in WHM.

Check cron jobs: malware often installs cron jobs to re-download itself. Check cPanel → Advanced → Cron Jobs for unexpected entries.

Scan again: run a full scan after cleanup to confirm nothing was missed.

Review file permissions: world-writable files and directories are common attack vectors. Set directories to 755 and files to 644.