Guide CyberPanel Malware Scan With ImunifyAV: What the Free Version Does - Printable Version +- AdminsForum (https://adminsforum.com) +-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels) +--- Forum: CyberPanel (https://adminsforum.com/Forum-cyberpanel) +---- Forum: CyberPanel Guides & Tutorials (https://adminsforum.com/Forum-cyberpanel-guides-tutorials) +----- Forum: CyberPanel Security Guides (https://adminsforum.com/Forum-cyberpanel-security-guides) +----- Thread: Guide CyberPanel Malware Scan With ImunifyAV: What the Free Version Does (/Thread-guide-cyberpanel-malware-scan-with-imunifyav-what-the-free-version-does)

CyberPanel Malware Scan With ImunifyAV: What the Free Version Does - JAY - 11-07-2026 CyberPanel Malware Scan With ImunifyAV: What the Free Version Does (Tested) CyberPanel comes with ImunifyAV, a free malware scanner from CloudLinux. It can scan every website on your server, show you exactly which file is infected and why, and scan again on a schedule. What it can't do for free is clean the files for you. That part is paid, and the panel doesn't tell you this until you click the button. We tested it on CyberPanel 3.0.8 (ImunifyAV 8.11) with a harmless test virus file, so every screenshot below shows a real detection, a real cleanup and a real clean result. Step 1: Open ImunifyAV In CyberPanel go to Security → ImunifyAV and click Access Now.     ImunifyAV opens on its own login page. Log in with your server's root username and password (the same ones you use for SSH as root). If you only log in with an SSH key and never set a root password, set one first with Code:Copy passwd over SSH. If the page is blank or broken, click Install Now lower on the same CyberPanel page. It runs the official install script again. If that also fails, run the three commands shown on that page yourself as root. Step 2: Pick what to scan The Users tab lists every website on the server by its Linux user and home folder. On our server that's one row per website.     Click the play button at the end of a row to scan that website, or Scan all to scan every site. Confirm with Yes, scan.     You can also open the Scan tab and type any folder (for example Code:Copy /home ) to scan everything under it. Step 3: Read the results Small sites take seconds. The Scan tab shows each scan with the number of files checked and the result. Our test site had 5 files and one of them was our test virus, so it says 1 file threat.     Notice the second row: the scanner also checks the site user's cron jobs ( Code:Copy /var/spool/cron/crontabs/... ). That's useful, because a lot of real infections hide a cron job that puts the malware back after you delete it. Open the Malicious tab to see every infected file: the full path, which website user owns it, the signature that matched (the Reason column) and its status.     The eye icon shows what's inside the file, so you can check for yourself before you delete anything.     The other two icons are clean up (the brush) and ignore (the crossed-out eye). Use ignore only for a file you are sure is a false positive. Step 4: Cleaning up (this is the paid part) Click the brush icon and ImunifyAV asks: Manual cleanup or Auto cleanup. Auto cleanup takes you straight to an upgrade page. One-click cleanup needs ImunifyAV+ or Imunify360, which are paid licences.     With the free version you clean up by hand. For a single bad file that's easy: delete it (or fix it) in CyberPanel's File Manager. Our test file was in Code:Copy public_html , so we selected it and clicked Delete.     Then go back to Users and scan the site again. It now says No malware found.     Step 5: Turn on regular scans Click the gear icon (Settings) and scroll to Background Scanning. In the free version you can only choose Never or Monthly, plus the day of the month and the time. Pick Monthly, choose a quiet hour, and click Save changes.     Monthly is a long gap. After anything suspicious (a hacked plugin in the news, strange redirects, spam in your mail queue), run a manual scan straight away instead of waiting. On the same Settings page you'll see the WordPress options (the Imunify WordPress plugin and WordPress WAF) were already ticked on our server. Leave them on unless they cause trouble with a site. Test it yourself safely Every antivirus recognises a standard harmless test file called EICAR. It's just one line of text and can't do anything. To check your scanner works, create a file called Code:Copy eicar-test.txt in a site's Code:Copy public_html with File Manager, paste this line into it and save: Code:Copy X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!H+H* Scan that site, check it shows up as a threat, then delete the file and scan again. If it finds real malware Deleting the file is only half the job. Malware almost always came in through something, and it will come back the same way. On a real infection: Take a backup first, even of the infected site, so you can't make things worse. Update everything: WordPress core, every plugin and theme. Delete plugins and themes you don't use. Look for more than one file. Scan the whole site, not just the folder you noticed. Check cron jobs in CyberPanel (Websites → your site → Cron Jobs) for anything you didn't add. Change passwords: WordPress admins, FTP, database and the CyberPanel account. If many core files are infected, restoring a clean backup is usually faster and safer than cleaning by hand. What about the AI Security Scanner? CyberPanel 3 also has an AI Scanner in the Security menu. It's a separate paid service: you add a card, it charges $10 up front, and each scan is charged from that balance. ImunifyAV is the free option. Quick answers Is ImunifyAV really free? Scanning, viewing results and monthly background scans are free. One-click cleanup is paid. Does it slow the server? Settings has CPU and I/O sliders for the scanner. Lower means gentler but slower scans. Which login does it use? Your server's root login, not your CyberPanel admin login. More security guides for CyberPanel: Firewall explained, SSH key login and File Manager and FTP. Questions or a scan result you can't read? Reply below (hide your server IP first).