Confirm the feature is enabled on your service. Keep a verified backup and record suspicious symptoms before making changes. If the site is actively harming visitors, ask support about appropriate containment while preserving evidence.

1. Open Virus Scanner and select a scope appropriate to the problem, such as public web files, mail or the entire home directory.
2. Start the scan and allow it to finish. Record the scan time, scope and reported file paths.
3. Review each detection before selecting an action. Distinguish a compromised live file from a malicious attachment, quarantined sample or obsolete backup copy.
4. Follow the available supported cleanup or quarantine workflow. If a legitimate application file must be replaced, obtain a clean copy from its trusted release source and preserve required configuration separately.
5. Update the affected application and extensions, rotate exposed credentials and rescan. Test the website and monitor for reinfection.

The identified threat should be removed or contained, and the underlying entry point should be addressed. Keep a record of changes so a broken application can be repaired without restoring the infection.

If the scanner is unavailable, it may not be installed or included. A false positive requires evidence and review, not a blanket exclusion for the entire website. Repeated detections after cleanup indicate that credentials, vulnerable software or a persistence mechanism still need investigation.

Only if that backup is clean and the cause is fixed. Otherwise the restored site can be compromised again. Validate the restore and close the original weakness.

• Correcting file permissions without using 777
• Downloading raw access logs for an incident investigation
• Testing a cPanel backup before a major website change
• Blocking an unwanted website visitor with cPanel IP Blocker

• cPanel: Virus Scanner