What ClamAV does on a cPanel server

ClamAV is a free, open-source antivirus engine. On a cPanel server it can scan:

• Website files in home folders and public_html, for malware and web shells.
• Email, including messages stored in mailboxes and, through Exim, messages sent by your users.
• Uploads through FTP and other file transfer methods, if you turn that on.

ClamAV is strongest on email and known malware files. For PHP malware, add Linux Malware Detect, which uses ClamAV’s engine with signatures written for hosting servers. cPanel also suggests ImunifyAV as an alternative scanner, so compare the two before you choose.

Requirements

• ✓ Root access to WHM on a VPS or dedicated server.
• ✓ Enough memory. cPanel recommends at least 3 GB of RAM when ClamAV is installed, because the virus database is loaded into memory.
• ✓ Spare disk I/O for scans. Run large scans outside busy hours.

Step 1: install ClamAV in WHM

1. Log in to WHM as root.
2. Open cPanel > Manage Plugins. You can also search for “Manage Plugins”.
3. Tick ClamAV for cPanel and click Save.
4. Wait for the installation to finish. The virus definitions are downloaded as part of the install.

Check that it works:

/usr/local/cpanel/3rdparty/bin/clamscan --version

Step 2: choose what users can scan

Open Plugins > Configure ClamAV Scanner in WHM. Choose the default scan types, such as mail, public web space and public FTP space, and save. You can also allow scanning per package or per account. Users then run scans from the Virus Scanner page in cPanel.

Step 3: scan email with Exim

Open Service Configuration > Exim Configuration Manager and, in the Basic Editor, look for the malware scanning options under the Security section. Turning on scanning of outgoing messages helps stop a hacked account from sending infected email from your server. Save, and send a test message to confirm mail still flows.

Step 4: keep the definitions up to date

Virus definitions are updated by freshclam. Update them by hand when you want the newest signatures before a scan:

/usr/local/cpanel/3rdparty/bin/freshclam

If freshclam reports an error, check that the server can reach the internet and that the disk is not full.

Option 1: the one-command scan helper

The helper script finds ClamAV, updates the definitions, and scans one folder at low priority, so websites stay responsive. It only reports infected files. It never deletes or moves anything.

1. Save the script below as clamav-scan.sh on the server, for example in /root.
2. Check the ClamAV version and definitions:

sudo bash clamav-scan.sh check

3. Scan a folder, for example one account’s website:

sudo bash clamav-scan.sh scan /home/USER/public_html

The helper script

Read the script before you run it. It does not download anything except virus definitions.

#!/usr/bin/env bash
# clamav-scan.sh
# Finds ClamAV (the cPanel plugin or the system package), updates the virus definitions,
# and scans a folder. It only reports infected files. It never deletes or moves anything.
#
# Usage (run as root):
#   sudo bash clamav-scan.sh check                   show the ClamAV version and definition date. Default.
#   sudo bash clamav-scan.sh scan /home/USER         update definitions, then scan the folder.

set -u

MODE="${1:-check}"
TARGET="${2:-}"

say()  { printf '%s\n' "$*"; }
have() { command -v "$1" >/dev/null 2>&1; }

if [ "$(id -u)" -ne 0 ]; then
  say "Run this script as root (sudo bash clamav-scan.sh $MODE)."
  exit 1
fi

# cPanel installs ClamAV in its own folder; otherwise use the system package
if [ -x /usr/local/cpanel/3rdparty/bin/clamscan ]; then
  BIN=/usr/local/cpanel/3rdparty/bin
  say "ClamAV source: cPanel plugin"
elif have clamscan; then
  BIN="$(dirname "$(command -v clamscan)")"
  say "ClamAV source: system package"
else
  say "ClamAV is not installed."
  say "On cPanel: WHM > cPanel > Manage Plugins > ClamAV for cPanel."
  say "Without cPanel: dnf install clamav clamav-update (EPEL), or apt install clamav."
  exit 1
fi

say "== Version and definitions =="
"$BIN/clamscan" --version

[ "$MODE" = "check" ] && exit 0
if [ "$MODE" != "scan" ]; then
  say "Unknown mode: $MODE. Use check or scan."
  exit 1
fi
if [ -z "$TARGET" ] || [ ! -d "$TARGET" ]; then
  say "Give a folder to scan, for example: sudo bash clamav-scan.sh scan /home/USER/public_html"
  exit 1
fi

say ""
say "== Updating definitions =="
if [ -x "$BIN/freshclam" ]; then
  "$BIN/freshclam" || say "Definition update failed. The scan will use the definitions already installed."
fi

LOG="/root/clamav-scan-$(date +%F-%H%M).log"
say ""
say "== Scanning $TARGET (low priority, report only) =="
nice -n 19 ionice -c3 "$BIN/clamscan" -ri --log="$LOG" "$TARGET"
RC=$?

say ""
case "$RC" in
  0) say "No infected files found. Log: $LOG" ;;
  1) say "Infected files found. Review the FOUND lines in $LOG before you change anything." ;;
  *) say "The scan ended with an error (code $RC). Check $LOG." ;;
esac

Option 2: scan from the command line

# Scan one account and list only infected files
/usr/local/cpanel/3rdparty/bin/clamscan -ri /home/USER

# Scan all accounts at low priority and keep a log
nice -n 19 ionice -c3 /usr/local/cpanel/3rdparty/bin/clamscan -ri --log=/root/clamscan.log /home

# Move infected files to a quarantine folder instead of deleting them
mkdir -p /root/quarantine
/usr/local/cpanel/3rdparty/bin/clamscan -ri --move=/root/quarantine /home/USER

Schedule a daily scan

cPanel recommends a daily root cron job outside busy hours. For example, to scan all websites at 03:30 every night:

# crontab -e (as root)
30 3 * * * nice -n 19 ionice -c3 /usr/local/cpanel/3rdparty/bin/clamscan -ri --log=/root/clamscan-daily.log /home/*/public_html

Check the log each morning, or send it to your email.

What to do when ClamAV finds something

1. Read the log. Each infected file is listed with the name of the signature it matched.
2. Check whether it is a real threat. Old backups, archives and email attachments are common finds.
3. Move the file to quarantine, or replace it with a clean copy from a backup.
4. Find how it got there: an outdated plugin, a weak password, or an infected computer used to upload files.
5. Update the site, change passwords, and scan again. See our cPanel security tips.

Troubleshooting