Protect cPanel & WHM with Free RootScan Malware Tool

Running a web‑hosting business with cPanel & WHM means you must constantly protect your servers and your customers’ sites from malware. cPanel includes basic security tools, but many administrators prefer an additional, lightweight layer that is easy to manage and free of charge. RootScan, provided by rootmanage.com, fills that niche. It scans the file system for known malicious signatures, suspicious code patterns, and risky permissions, then displays a concise report inside WHM.

What Is RootScan and How Does It Work?

RootScan is a standalone script that integrates with WHM through a simple cPanel plugin. It does not replace cPanel’s built‑in VirusScanner; instead, it complements it by focusing on:

• Known malware signatures gathered from public repositories.
• Heuristic checks for obfuscated PHP, base64‑encoded strings, and heavy use of eval.
• File‑ownership and permission anomalies that often indicate a compromised account.

The script runs as root, giving it read access to every account’s files. After a scan it writes a summary to /var/log/rootscan.log and adds a clickable entry in the WHM sidebar so you can view results without leaving the interface.

Why Choose a Free Solution?

Commercial malware scanners usually charge per‑server or per‑account, which can quickly become costly for small‑to‑medium providers. RootScan’s free model offers:

• No recurring fees or license keys.
• Transparency similar to open source— the script can be inspected directly on the server.
• Simple deployment: a single command installs the plugin and creates a daily cron job.

Because the project is community‑maintained, keep the script up to date. RootScan includes a daily update mechanism that pulls the latest signature database.

Installing RootScan on a cPanel & WHM Server

RootScan works on any Linux distribution that supports cPanel (CentOS, AlmaLinux, Rocky Linux, Debian, Ubuntu, etc.). Below are installation steps for the two most common package families.

Debian / Ubuntu (apt)

# Update the package index
apt update

# Install required utilities (curl, tar, unzip)
apt install -y curl tar unzip

# Download the installer script
curl -L https://rootmanage.com/downloads/rootscan-installer.sh -o /tmp/rootscan-installer.sh

# Make the script executable
chmod +x /tmp/rootscan-installer.sh

# Run the installer as root
/tmp/rootscan-installer.sh

# The installer will:
#   1. Create /usr/local/rootscan directory
#   2. Place the main script (rootscan.php) there
#   3. Register the WHM plugin (adds a menu entry)
#   4. Set up a daily cron job at /etc/cron.d/rootscan

AlmaLinux / Rocky Linux / RHEL (dnf)

# Ensure the system is up to date
dnf update -y

# Install required utilities (curl, tar, unzip)
dnf install -y curl tar unzip

# Download the installer script
curl -L https://rootmanage.com/downloads/rootscan-installer.sh -o /tmp/rootscan-installer.sh

# Make the script executable
chmod +x /tmp/rootscan-installer.sh

# Execute the installer as root
/tmp/rootscan-installer.sh

# The installer performs the same actions as described for Debian/Ubuntu.

Note: Windows Server does not run cPanel, so RootScan is not applicable there.

Running a Scan and Interpreting the Results

Using the WHM Interface

1. Log in to WHM as root.
2. Find the “RootScan” icon in the left sidebar (usually under Plugins).
3. Click “Run Scan”. A progress bar appears, followed by a summary when the scan finishes.

Command‑Line Invocation

# Full scan (examines every file)
/usr/local/rootscan/rootscan.php --full

# Quick scan (skips deep heuristic checks)
/usr/local/rootscan/rootscan.php --quick

# Export results to JSON for external processing
/usr/local/rootscan/rootscan.php --export=json > /root/rootscan-report.json

The flags control the depth of analysis. --full checks every file, while --quick focuses on recently modified files and known signatures.

Understanding the WHM Report

The report groups findings by severity:

• Critical – Files that match known malware signatures or contain dangerous PHP constructs such as eval(base64_decode(...)).
• Warning – Files with risky permissions (e.g., world‑writable) or unusual ownership.
• Info – Files that were scanned and found clean.

Each entry shows the file path, a short description, and a “Take Action” button that lets you quarantine, delete, or ignore the file directly from WHM.

Best Practices for Using RootScan

• Schedule regular scans. The installer creates a daily cron job; consider adding a weekly full scan during low‑traffic periods.
• Review before deleting. Some false positives involve legitimate scripts that use eval. Verify with the account owner when possible.
• Combine with other tools. Keep cPanel’s VirusScanner enabled and consider a host‑based IDS such as Fail2Ban for broader protection.
• Keep signatures current. Updates run automatically, but you can force a refresh with:
  

  /usr/local/rootscan/rootscan.php --update-signatures

• Backup before remediation. If you plan to delete or replace infected files, create a snapshot or tarball of the affected account first.

Limitations and When to Seek Additional Help

RootScan is an effective first line of defense, but it does not replace a comprehensive security audit. Its main limitations are:

• Dependence on known signatures—zero‑day malware may go undetected.
• Heuristic checks can generate false positives, especially with custom applications.
• No real‑time monitoring—malware introduced after the last scan remains unseen until the next run.

If the same account experiences repeated infections, conduct a deeper investigation: examine SSH logs, verify credential security, and consider rebuilding the account from a clean backup.

Conclusion

RootScan provides a straightforward, free method to add malware scanning to a cPanel & WHM environment. Its WHM integration lets administrators run scans, review findings, and act immediately without leaving the control panel. By installing the tool, scheduling regular scans, and following the best‑practice guidelines above, you can reduce the risk of malware spreading across your servers while keeping costs low. Remember that no single scanner guarantees complete protection; combine RootScan with cPanel’s native tools and a solid backup strategy for the best results.