ImunifyAV on cPanel: Uninstall, Stop Reinstall, Update and Scan

Short answer: to uninstall ImunifyAV from cPanel (the ImunifyAV cPanel plugin and its packages), run wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh and then bash imav-deploy.sh --uninstall as root. That removes the packages but keeps the settings and about 190 MB of data in /var/imunify360. Use bash imav-deploy.sh --purge to remove those too. cPanel installs ImunifyAV only once, during the first cPanel install, and the nightly upcp does not bring it back. To make sure cPanel never installs it, create the file /var/cpanel/noimunifyav.

Applies to ImunifyAV 8.9.2 and 8.9.3 (force update); cPanel & WHM 138.0 build 15; AlmaLinux 9.8; lab test 11 Oct 2026

We tested every command on this page on our cPanel lab server (cPanel & WHM 138.0 build 15, AlmaLinux 9.8) on 11 October 2026: the status checks, an on-demand scan, the normal and forced update (8.9.2 to 8.9.3), --uninstall, --purge and a fresh reinstall. The reinstall rule comes from cPanel’s own code on that server (Cpanel/TaskProcessors/ImunifyTasks.pm). Licensing an ImunifyAV+ key was not tested, because we have no AV+ key; that command is from the Imunify documentation.

Is ImunifyAV installed and running?

ImunifyAV is the free malware scanner from CloudLinux, and cPanel installs it automatically on new cPanel servers. Check for it with:

rpm -q imunify-antivirus          # package and version (dpkg -l imunify-antivirus on Ubuntu)
imunify-antivirus version         # agent version, e.g. 8.9.2
imunify-antivirus rstatus         # licence/registration check: prints OK
systemctl list-units --all "imunify*" "aibolit*"

Do not be surprised if systemctl is-active imunify-antivirus says inactive. The agent is socket-activated: imunify-antivirus.socket and its sensor sockets stay listening, and the service starts when something talks to it, such as a CLI command, the WHM page or a scan. On our lab it showed inactive and then active (running) a few seconds after the first imunify-antivirus command.

One more thing that confuses people: on an ImunifyAV server, /usr/bin/imunify360-agent is a link to /usr/bin/imunify-antivirus. A working imunify360-agent command does not mean Imunify360 is installed. Check the package name instead (imunify-antivirus versus imunify360-firewall).

ImunifyAV commands quick reference

Task	Command	Notes
Version	imunify-antivirus version	Agent version
Licence status	imunify-antivirus rstatus	OK when registered (the free tier registers itself)
Activate ImunifyAV+ key	imunify-antivirus register YOUR_KEY	From the Imunify docs; not tested
Refresh licence	imunify-antivirus update-license	Forces a licence refresh
Scan a folder	imunify-antivirus malware on-demand queue put /home/USER/public_html	Replaces the deprecated on-demand start
Scan progress	imunify-antivirus malware on-demand status	status: stopped when finished
Past scans	imunify-antivirus malware on-demand list	Files scanned, malicious count, duration
Infected files	imunify-antivirus malware malicious list	Empty output means nothing found
Ignore a path	imunify-antivirus malware ignore add /path	Also list and delete
Show settings	imunify-antivirus config show	JSON; change settings with config update or config patch
Update	yum update imunify-antivirus	apt-get install --only-upgrade imunify-antivirus on Ubuntu
Force update	bash imunify-force-update.sh	Skips the staged roll-out (see below)
Uninstall	bash imav-deploy.sh --uninstall	Keeps data and settings
Uninstall and clean up	bash imav-deploy.sh --purge	Removes almost everything
Install or reinstall	bash imav-deploy.sh	Took 82 seconds on our lab

Scan a folder from the command line

Queue a scan, wait for it to finish, then read the result:

imunify-antivirus malware on-demand queue put /home/site1/public_html
imunify-antivirus malware on-demand status       # repeat until: status: stopped
imunify-antivirus malware on-demand list --limit 1
imunify-antivirus malware malicious list         # infected files, if any

On our lab the scan of a fresh WordPress site took 13 seconds for 3,816 files and found nothing (TOTAL_MALICIOUS 0). queue put also accepts --intensity low|moderate|high and --file-mask/--ignore-mask, which help on busy servers. The free tier finds malware but does not clean it; automatic cleanup needs ImunifyAV+ or Imunify360. For the clean-up commands, see Imunify360 CLI: scan, list and clean malware.

Update and force update ImunifyAV

A normal update only installs what the staged roll-out has released for your server:

yum update imunify-antivirus                                          # AlmaLinux, Rocky, CloudLinux
apt-get update && apt-get install --only-upgrade imunify-antivirus    # Ubuntu

Imunify releases new versions in stages. To get the newest build before the roll-out reaches your server, use the official force-update script:

wget -O imunify-force-update.sh https://repo.imunify360.cloudlinux.com/defence360/imunify-force-update.sh
bash imunify-force-update.sh

We read the script before running it. It runs yum update with the imunify360-rollout-*-bypass repositories enabled, then checks package integrity and reinstalls any package that fails the check. On our lab the normal repository offered 8.9.2 as the newest version. The force update installed imunify-antivirus 8.9.3 from imunify360-rollout-6-bypass, together with newer ai-bolit and app-version-detector packages. Because a forced build has not finished its roll-out, test it on one server first. Our Imunify force update and rollback guide covers going back.

Uninstall the ImunifyAV cPanel plugin

Run these as root over SSH, or from WHM → Terminal:

wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh
bash imav-deploy.sh --uninstall     # remove the packages, keep data and settings
# or
bash imav-deploy.sh --purge         # remove the packages and the leftover files
systemctl daemon-reload             # clears the old imunify units from systemctl

On our lab, --uninstall removed 48 packages in about 15 seconds. They were ImunifyAV itself, the WHM and cPanel plugin, ai-bolit, imunify-wp-security and Imunify’s private copies of PHP and Python (the alt-php-internal and alt-python-internal packages). Nothing outside Imunify was removed: JetBackup, cPanel and WHM kept working. This is what each option left behind:

Path or item	Before	After --uninstall	After --purge
/var/imunify360 (database, scan data)	191 MB	191 MB	Removed
/opt/imunify360	131 MB	100 KB	Removed
/usr/local/cpanel/whostmgr/docroot/cgi/imunify	63 MB	32 MB	Removed
/etc/sysconfig/imunify360 (settings)	156 KB	72 KB	Removed
/etc/imunify360	36 KB	36 KB	Removed
/var/log/imunify360 (logs)	2.2 MB	2.2 MB	2.2 MB (kept)
/usr/share/imunify360	12 MB	4 KB	4 KB (empty)
/etc/cron.d/imunify-* (4 files)	Yes	Removed	Removed
System user _imunify	Yes	Kept	Kept

So --uninstall is the right choice if you may reinstall later and want to keep your ignore list and settings. --purge is for a clean removal. After --purge you can delete /var/log/imunify360, /usr/share/imunify360 and the _imunify user yourself (userdel _imunify) if you want no trace left.

Stop cPanel from installing ImunifyAV again

We checked how cPanel installs ImunifyAV by reading the code on our cPanel 138 server. The first cPanel installation schedules a background task, install_imunifyav. If the installation fails, the task retries with growing delays, up to 10 attempts. upcp, the nightly update, does not schedule it, so an uninstalled ImunifyAV stays uninstalled after updates.

Two touch files tell cPanel not to install it:

touch /var/cpanel/noimunifyav      # never install ImunifyAV
touch /var/cpanel/noimunify360     # never install Imunify360

The task checks the file before every attempt. Creating it also stops a retry chain that is already running; at most one queued retry still fires, and it does nothing. On a brand-new server you can skip ImunifyAV from the start by passing --skip-imunifyav to the cPanel installer, which creates the same touch file.

Reinstall ImunifyAV or move to AV+ or Imunify360

To reinstall the free version, run bash imav-deploy.sh. If you created the /var/cpanel/noimunifyav file, delete it first. On our lab the reinstall after --purge took 82 seconds and ended with ImunifyAV is started and Success; the WHM plugin was back immediately. The deploy script also takes a key:

bash imav-deploy.sh --key YOUR_KEY     # install with an ImunifyAV+ key
bash imav-deploy.sh --key IPL          # IP-based licence
imunify-antivirus register YOUR_KEY    # register a key on an existing install

Imunify360 is a different product: firewall, WAF, malware cleanup and more. It is installed with its own script, i360deploy.sh, and its own licence. See our Imunify360 review before buying.

Logs and configuration files

File	What it holds
/var/log/imav-deploy.log	Install, uninstall and purge runs of imav-deploy.sh
/var/cpanel/imunifyav-install.log	cPanel’s automatic install of ImunifyAV
/var/log/imunify360/console.log	Main agent log (rotated daily)
/var/log/imunify360/error.log	Agent errors
/var/log/imunify360/aibolit_actions.log	Scanner actions
/etc/sysconfig/imunify360/imunify360.config.d/90-local.config	Local settings written by config patch
/etc/sysconfig/imunify360/imunify360-merged.config	The effective settings after all files are merged

Common problems

• The service shows inactive. That is normal: it is socket-activated. Check the sockets with systemctl list-units "imunify*", or run imunify-antivirus rstatus.
• systemctl still lists imunify units after uninstalling. Run systemctl daemon-reload; on our lab they disappeared after that.
• Disk space is not freed after uninstalling. --uninstall keeps /var/imunify360 (191 MB on our small lab, more on a busy server). Use --purge.
• imunify360-agent works, so Imunify360 must be installed? No. On ImunifyAV it is a link to imunify-antivirus.
• ImunifyAV came back on a new server. It was installed by cPanel’s first-install task, not by upcp. Create /var/cpanel/noimunifyav before or right after installing cPanel.
• The WHM plugin page is blank after a reinstall. Reload WHM. If it stays blank, see Imunify360 missing from WHM; the same fixes apply to ImunifyAV.

Vendor reference: the Imunify360 and ImunifyAV documentation.

Frequently asked questions

Reading a lot of our guides? Go ad-free with srvScripts Pro for $6 a month. It also pays for new guides. Cancel any time.