# ImunifyAV on cPanel: Uninstall, Stop Reinstall, Update and Scan Source: https://srvscripts.com/guides/imunifyav-cpanel-uninstall-update-commands/ Updated: 2026-10-17 Publisher: srvScripts (https://srvscripts.com/) **Short answer:** to uninstall ImunifyAV from cPanel (the ImunifyAV cPanel plugin and its packages), run `wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh` and then `bash imav-deploy.sh --uninstall` as root. That removes the packages but keeps the settings and about 190 MB of data in `/var/imunify360`. Use `bash imav-deploy.sh --purge` to remove those too. cPanel installs ImunifyAV only once, during the first cPanel install, and the nightly `upcp` does not bring it back. To make sure cPanel never installs it, create the file `/var/cpanel/noimunifyav`. In short: to uninstall ImunifyAV from cPanel (the ImunifyAV cPanel plugin and its packages), run wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh and then bash imav-deploy.sh --un… We tested every command on this page on our cPanel lab server (cPanel & WHM 138.0 build 15, AlmaLinux 9.8) on 11 October 2026: the status checks, an on-demand scan, the normal and forced update (8.9.2 to 8.9.3), `--uninstall`, `--purge` and a fresh reinstall. The reinstall rule comes from cPanel’s own code on that server (`Cpanel/TaskProcessors/ImunifyTasks.pm`). Licensing an ImunifyAV+ key was not tested, because we have no AV+ key; that command is from the Imunify documentation. ## Is ImunifyAV installed and running? ImunifyAV is the free malware scanner from CloudLinux, and cPanel installs it automatically on new cPanel servers. Check for it with: ``` rpm -q imunify-antivirus # package and version (dpkg -l imunify-antivirus on Ubuntu) imunify-antivirus version # agent version, e.g. 8.9.2 imunify-antivirus rstatus # licence/registration check: prints OK systemctl list-units --all "imunify*" "aibolit*" ``` Do not be surprised if `systemctl is-active imunify-antivirus` says `inactive`. The agent is socket-activated: `imunify-antivirus.socket` and its sensor sockets stay listening, and the service starts when something talks to it, such as a CLI command, the WHM page or a scan. On our lab it showed `inactive` and then `active (running)` a few seconds after the first `imunify-antivirus` command. One more thing that confuses people: on an ImunifyAV server, `/usr/bin/imunify360-agent` is a link to `/usr/bin/imunify-antivirus`. A working `imunify360-agent` command does not mean Imunify360 is installed. Check the package name instead (`imunify-antivirus` versus `imunify360-firewall`). ## ImunifyAV commands quick reference | Task | Command | Notes | | --- | --- | --- | | Version | imunify-antivirus version | Agent version | | Licence status | imunify-antivirus rstatus | OK when registered (the free tier registers itself) | | Activate ImunifyAV+ key | imunify-antivirus register YOUR_KEY | From the Imunify docs; not tested | | Refresh licence | imunify-antivirus update-license | Forces a licence refresh | | Scan a folder | imunify-antivirus malware on-demand queue put /home/USER/public_html | Replaces the deprecated on-demand start | | Scan progress | imunify-antivirus malware on-demand status | status: stopped when finished | | Past scans | imunify-antivirus malware on-demand list | Files scanned, malicious count, duration | | Infected files | imunify-antivirus malware malicious list | Empty output means nothing found | | Ignore a path | imunify-antivirus malware ignore add /path | Also list and delete | | Show settings | imunify-antivirus config show | JSON; change settings with config update or config patch | | Update | yum update imunify-antivirus | apt-get install --only-upgrade imunify-antivirus on Ubuntu | | Force update | bash imunify-force-update.sh | Skips the staged roll-out (see below) | | Uninstall | bash imav-deploy.sh --uninstall | Keeps data and settings | | Uninstall and clean up | bash imav-deploy.sh --purge | Removes almost everything | | Install or reinstall | bash imav-deploy.sh | Took 82 seconds on our lab | ## Scan a folder from the command line Queue a scan, wait for it to finish, then read the result: ``` imunify-antivirus malware on-demand queue put /home/site1/public_html imunify-antivirus malware on-demand status # repeat until: status: stopped imunify-antivirus malware on-demand list --limit 1 imunify-antivirus malware malicious list # infected files, if any ``` On our lab the scan of a fresh WordPress site took 13 seconds for 3,816 files and found nothing (`TOTAL_MALICIOUS 0`). `queue put` also accepts `--intensity low|moderate|high` and `--file-mask`/`--ignore-mask`, which help on busy servers. The free tier finds malware but does not clean it; automatic cleanup needs ImunifyAV+ or Imunify360. For the clean-up commands, see [Imunify360 CLI: scan, list and clean malware](/guides/imunify360-cli-malware-cleanup/). ## Update and force update ImunifyAV A normal update only installs what the staged roll-out has released for your server: ``` yum update imunify-antivirus # AlmaLinux, Rocky, CloudLinux apt-get update && apt-get install --only-upgrade imunify-antivirus # Ubuntu ``` Imunify releases new versions in stages. To get the newest build before the roll-out reaches your server, use the official force-update script: ``` wget -O imunify-force-update.sh https://repo.imunify360.cloudlinux.com/defence360/imunify-force-update.sh bash imunify-force-update.sh ``` We read the script before running it. It runs `yum update` with the `imunify360-rollout-*-bypass` repositories enabled, then checks package integrity and reinstalls any package that fails the check. On our lab the normal repository offered 8.9.2 as the newest version. The force update installed `imunify-antivirus 8.9.3` from `imunify360-rollout-6-bypass`, together with newer `ai-bolit` and `app-version-detector` packages. Because a forced build has not finished its roll-out, test it on one server first. Our [Imunify force update and rollback guide](/guides/imunify360-force-update-rollback/) covers going back. ## Uninstall the ImunifyAV cPanel plugin Run these as root over SSH, or from WHM → Terminal: ``` wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh bash imav-deploy.sh --uninstall # remove the packages, keep data and settings # or bash imav-deploy.sh --purge # remove the packages and the leftover files systemctl daemon-reload # clears the old imunify units from systemctl ``` On our lab, `--uninstall` removed 48 packages in about 15 seconds. They were ImunifyAV itself, the WHM and cPanel plugin, `ai-bolit`, `imunify-wp-security` and Imunify’s private copies of PHP and Python (the `alt-php-internal` and `alt-python-internal` packages). Nothing outside Imunify was removed: JetBackup, cPanel and WHM kept working. This is what each option left behind: | Path or item | Before | After --uninstall | After --purge | | --- | --- | --- | --- | | /var/imunify360 (database, scan data) | 191 MB | 191 MB | Removed | | /opt/imunify360 | 131 MB | 100 KB | Removed | | /usr/local/cpanel/whostmgr/docroot/cgi/imunify | 63 MB | 32 MB | Removed | | /etc/sysconfig/imunify360 (settings) | 156 KB | 72 KB | Removed | | /etc/imunify360 | 36 KB | 36 KB | Removed | | /var/log/imunify360 (logs) | 2.2 MB | 2.2 MB | 2.2 MB (kept) | | /usr/share/imunify360 | 12 MB | 4 KB | 4 KB (empty) | | /etc/cron.d/imunify-* (4 files) | Yes | Removed | Removed | | System user _imunify | Yes | Kept | Kept | So `--uninstall` is the right choice if you may reinstall later and want to keep your ignore list and settings. `--purge` is for a clean removal. After `--purge` you can delete `/var/log/imunify360`, `/usr/share/imunify360` and the `_imunify` user yourself (`userdel _imunify`) if you want no trace left. ## Stop cPanel from installing ImunifyAV again We checked how cPanel installs ImunifyAV by reading the code on our cPanel 138 server. The first cPanel installation schedules a background task, `install_imunifyav`. If the installation fails, the task retries with growing delays, up to 10 attempts. `upcp`, the nightly update, does not schedule it, so an uninstalled ImunifyAV stays uninstalled after updates. Two touch files tell cPanel not to install it: ``` touch /var/cpanel/noimunifyav # never install ImunifyAV touch /var/cpanel/noimunify360 # never install Imunify360 ``` The task checks the file before every attempt. Creating it also stops a retry chain that is already running; at most one queued retry still fires, and it does nothing. On a brand-new server you can skip ImunifyAV from the start by passing `--skip-imunifyav` to the cPanel installer, which creates the same touch file. ## Reinstall ImunifyAV or move to AV+ or Imunify360 To reinstall the free version, run `bash imav-deploy.sh`. If you created the `/var/cpanel/noimunifyav` file, delete it first. On our lab the reinstall after `--purge` took 82 seconds and ended with `ImunifyAV is started` and `Success`; the WHM plugin was back immediately. The deploy script also takes a key: ``` bash imav-deploy.sh --key YOUR_KEY # install with an ImunifyAV+ key bash imav-deploy.sh --key IPL # IP-based licence imunify-antivirus register YOUR_KEY # register a key on an existing install ``` Imunify360 is a different product: firewall, WAF, malware cleanup and more. It is installed with its own script, `i360deploy.sh`, and its own licence. See [our Imunify360 review](/reviews/imunify360-review/) before buying. ## Logs and configuration files | File | What it holds | | --- | --- | | /var/log/imav-deploy.log | Install, uninstall and purge runs of imav-deploy.sh | | /var/cpanel/imunifyav-install.log | cPanel’s automatic install of ImunifyAV | | /var/log/imunify360/console.log | Main agent log (rotated daily) | | /var/log/imunify360/error.log | Agent errors | | /var/log/imunify360/aibolit_actions.log | Scanner actions | | /etc/sysconfig/imunify360/imunify360.config.d/90-local.config | Local settings written by config patch | | /etc/sysconfig/imunify360/imunify360-merged.config | The effective settings after all files are merged | ## Common problems - **The service shows inactive.** That is normal: it is socket-activated. Check the sockets with `systemctl list-units "imunify*"`, or run `imunify-antivirus rstatus`. - **systemctl still lists imunify units after uninstalling.** Run `systemctl daemon-reload`; on our lab they disappeared after that. - **Disk space is not freed after uninstalling.** `--uninstall` keeps `/var/imunify360` (191 MB on our small lab, more on a busy server). Use `--purge`. - **imunify360-agent works, so Imunify360 must be installed?** No. On ImunifyAV it is a link to `imunify-antivirus`. - **ImunifyAV came back on a new server.** It was installed by cPanel’s first-install task, not by `upcp`. Create `/var/cpanel/noimunifyav` before or right after installing cPanel. - **The WHM plugin page is blank after a reinstall.** Reload WHM. If it stays blank, see [Imunify360 missing from WHM](/guides/fix-imunify360-missing-from-whm/); the same fixes apply to ImunifyAV. Vendor reference: the [Imunify360 and ImunifyAV documentation](https://docs.imunify360.com/). ## Frequently asked questions ### How do I completely remove ImunifyAV from cPanel? Run bash imav-deploy.sh --purge as root (download the script from repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh first), then systemctl daemon-reload. Only the logs in /var/log/imunify360, an empty /usr/share/imunify360 and the _imunify user remain. ### Will cPanel reinstall ImunifyAV after I remove it? Not during normal updates. cPanel installs ImunifyAV once, in the first-install task. To be sure, create /var/cpanel/noimunifyav; the install task checks it before every attempt. ### Is it safe to uninstall ImunifyAV? Yes, on our cPanel 138 lab the uninstall removed only Imunify packages and its private PHP and Python copies. cPanel, WHM and JetBackup kept working. You lose malware scanning, so put another scanner in place, such as Maldet with ClamAV or Imunify360. ### How do I force an ImunifyAV update? Download imunify-force-update.sh from repo.imunify360.cloudlinux.com/defence360/ and run it. It updates from the roll-out bypass repositories and then checks package integrity. On our lab it moved ImunifyAV from 8.9.2 to 8.9.3. ### What is the difference between --uninstall and --purge? --uninstall removes the packages but keeps data and settings, including 191 MB in /var/imunify360 on our lab. --purge also removes those files, leaving only the logs and the _imunify user.