🛡️ Install & Use ClamAV on cPanel/WHM (2025)

By /

Environment:

  • AlmaLinux / CloudLinux 8/9
  • WHM/cPanel (v126+)
  • Root SSH access

🔧 Step 1: Install ClamAV via WHM

  1. Login to WHM as root.
  2. Go to:
    WHM >> cPanel >> Manage Plugins
  3. Check the box for:
    ✅ clamavconnector – Install and Keep Updated
  4. Click Save at the bottom of the page.
  5. WHM will now install ClamAV under /usr/local/cpanel/3rdparty/bin/.

🔄 Step 2: Update ClamAV Virus Definitions

SSH into your server and run:

freshclam

If the command is not found, continue to Step 6 (symlink fix).

🧪 Step 3: Scan the /home Directory and Save Output

clamscan -ir /home > logs.txt
  • -i: Only print infected files.
  • -r: Recursive scan.
  • logs.txt: Output file in current directory.

❗ Step 4: If You See -bash: clamscan: command not found

Run:

/scripts/restartsrv_clamd

If you see “Unable to locate clamd”, proceed to Step 5.

📦 Step 5: Manually Install ClamAV (Optional/Fallback)

If the WHM install fails or you need a system-wide install:

For AlmaLinux 8/9 or CloudLinux 8/9:

dnf install epel-release -y
dnf install clamav clamav-update -y
freshclam

Then restart clamd if installed:

systemctl enable --now clamd@scan

You can now use clamscan normally.

🔁 Step 6: Fix WHM Install Not Available via CLI

If WHM installation succeeded but clamscan/freshclam don’t work from CLI:

A. Confirm installation paths:

ls -lah /usr/local/cpanel/3rdparty/bin/*clam*

You should see binaries like clamscan, clamd, freshclam.

B. Check if they exist in /usr/local/bin:

ls -l /usr/local/bin/*clam*

If not, create symbolic links:

ln -s /usr/local/cpanel/3rdparty/bin/freshclam /usr/local/bin/freshclam
ln -s /usr/local/cpanel/3rdparty/bin/clamscan /usr/local/bin/clamscan
ln -s /usr/local/cpanel/3rdparty/bin/clamd /usr/local/bin/clamd
ln -s /usr/local/cpanel/3rdparty/bin/clamav-config /usr/local/bin/clamav-config

Confirm:

ls -l /usr/local/bin/*clam*

🔍 Step 7: Scan Public Web Content

To scan all public_html directories of all users:

clamscan -ir /home/*/public_html > /usr/local/src/scan.txt

✅ Result stored in: /usr/local/src/scan.txt

📄 Step 8: View the Scan Results

cat /usr/local/src/scan.txt

📌 Optional Tips

  • Add to cron for weekly scans: crontab -e Example weekly scan entry: 0 3 * * 0 clamscan -ir /home/*/public_html > /usr/local/src/weekly_scan.txt
  • Schedule freshclam to update hourly: echo "0 * * * * /usr/local/bin/freshclam --quiet" >> /etc/crontab
Scroll to Top