Resolve a malware finding

Use Threat & Malware Detection in cPFence v4+ to resolve a recorded malware finding. Support users need access to the server and scan history, plus permission for each file action. A finding does not mean its file was quarantined successfully.

1. Review the file and action

1. Choose the affected server in Server scope, then open Scan Summary.
2. Select Needs attention to open Unresolved files, or find the scan in Recent scans and open Details.
3. Check the file’s Path, Signature, and Action. Select Preview to read the file’s content, and compare its path with the affected website before changing anything.
4. Choose an available action for that row. Controls depend on the finding’s state and your permissions.

Action	What it does
Quarantine	Moves the detected file into quarantine, retaining bytes for supported recovery.
Delete	Permanently removes the detected file without quarantine recovery.
Restore	Returns stored quarantine bytes to the original path.
Mark as safe	Keeps the file where it is, stops warning about it and skips it in future scans. Undo it with Scan again under Safe files.
Report false positive	Sends the file to cPFence support for review. See report a false positive.

Check before removing a website file

Quarantine or deletion can break the website. Delete cannot be undone through quarantine recovery. Verify the finding and a usable backup before choosing it.

2. Quarantine or delete deliberately

1. Choose Quarantine or Delete on the intended finding.
2. Read the confirmation’s path and server.
3. Choose Move to quarantine or Delete permanently, or Cancel to leave the file unchanged.
4. Read the per-file result and refresh the scan record. Confirm the site’s normal operation afterward.

An error or interrupted action is not proof that the file stayed unchanged. Inspect the recorded result and current file state before using Retry quarantine or Retry delete. A changed file at the original path requires a fresh review.

3. Recover verified content

Follow identify and restore quarantined files to preview stored content and check its original path. An existing destination or missing payload can prevent recovery.

Use the quarantine list to identify stored content before recovery. Identifying values and paths are blurred. Select the image for full size; use browser Back to return.

Trust only known-clean content

Verify the file before adding a narrow exception or selecting Also mark as safe during restore. Returning malware makes it available to the website again.

A file marked as safe stays skipped even if its contents change. Keep it deliberately, and choose Scan again under Safe files when it is no longer needed.

Restore without Also mark as safe can leave Restored — action required. If you later verify that content is clean, use Mark as safe on the finding and read its confirmation. Remove an unnecessary exception through the exclusion controls.

4. Record a file already removed outside cPFence

If the detected file is no longer present, the row offers Mark fixed. First verify your external remediation, then choose Mark fixed and read the confirmation: the server checks that the file is still absent and preserves scan history. To do this for every missing file at once, choose Mark deleted files fixed on the Scan Summary status card.

Mark fixed records resolution; it does not clean a file or establish that the entire website is safe. If the check fails, inspect the reported condition rather than retrying blindly. Run an appropriate follow-up scan after remediation.