# Scan your account with Virus Scanner
Source: https://docs.webgee.com/en/security-ssl/virus-scanner





**Virus Scanner** runs a ClamAV scan across your hosting account. Applies to
shared, reseller and Premium hosting on cPanel.

In cPanel, open **Virus Scanner** in the **Advanced** section.

<img alt="The Virus Scanner scan targets" src="__img0" />

## Choose what to scan [#choose-what-to-scan]

| Target                         | Covers                    | Use when                                                |
| ------------------------------ | ------------------------- | ------------------------------------------------------- |
| **Scan Entire Home Directory** | Everything in the account | You do not know where the problem is                    |
| **Scan Mail**                  | The mail store            | Mailboxes are sending or receiving infected attachments |
| **Scan Public FTP Space**      | `public_ftp`              | You accept uploads over FTP                             |
| **Scan Public Web Space**      | `public_html`             | You suspect the website itself                          |

Start with **Scan Public Web Space** if a site is misbehaving — it is much
faster than the whole account and covers where web malware actually lives.

Select **Scan Now**.

Scans stop automatically if they run for more than a day. On a large account the
full home directory scan can take a long time, which is another reason to
narrow the target.

## What it finds, and what it does not [#what-it-finds-and-what-it-does-not]

ClamAV matches known signatures. It is good at finding recognised malware and
infected attachments.

<Callout type="warn">
  A clean result does not mean the account is clean. Most WordPress compromises
  are obfuscated PHP written to look like ordinary theme code, and signature
  scanning routinely misses them. Do not treat a clean scan as proof.
</Callout>

For a genuine compromise, use the server's own protection, which does behavioural
detection rather than signatures alone:

* [Scan your sites for malware](/en/security-ssl/malware-scanner-how-to-scan-your-sites-for-malware)
* [Clean malware from your website](/en/security-ssl/steps-to-cleaning-malware-from-your-website)

## If it finds something [#if-it-finds-something]

Do not simply delete the file and stop. A single infected file is almost always
a symptom — the attacker got in somehow, and if the route is still open the file
returns.

Work through
[Clean malware from your website](/en/security-ssl/steps-to-cleaning-malware-from-your-website),
which covers closing the entry point as well as removing the payload.

## Related [#related]

* [Scan your sites for malware](/en/security-ssl/malware-scanner-how-to-scan-your-sites-for-malware)
* [Clean malware from your website](/en/security-ssl/steps-to-cleaning-malware-from-your-website)