Malware scanner for every customer website.
Linux Malware Detect + ClamAV. Detects PHP webshells, backdoors, injected code and compromised CMS files. Real coverage percentage instead of a marketing number, quarantine, false-positive flagging and daily auto-updates — right from the panel.
Two proven scanners, one interface.
Linux Malware Detect (rfxn.com — the shared-hosting standard since 2002) and ClamAV (Cisco Talos) work together — with real scan transparency instead of a marketing number.
- Real coverage percentage for every single scan — no blanket marketing number
- Timestamp of the last virus-definition update — always visible
- List of skipped files including the reason (size, type, permissions)
- URLhaus & MalwarePatrol — phishing URL feeds
- YARA CVE rules for 0-day vulnerabilities
- Hourly core updates, daily extended updates
What the scanner detects and how
Three detection layers: MD5 hashes of known malware, HEX patterns in files, YARA rules for structural detection.
PHP webshells
b374k, c99, r57, WSO, FilesMan, hexshell and more HEX signatures — the most common WordPress and Joomla compromises.
Obfuscated code
eval(base64_decode()), gzinflate chains, str_rot13 wrappers. YARA rules identify code structure, not just the hash.
Mail malware
Sanesecurity signatures detect phishing templates, malicious macros (badmacro.ndb), Foxhole samples. rspamd uses ClamAV automatically for mail scanning.
Scan modes
Quick scan (files changed in the last 7 days) or full scan. Low I/O priority (nice 19, ionice 6) never competes with live traffic.
Quarantine & false positive
Move a flagged file to .quarantine/ with one click (root-owned dir, PHP has no read access). Or mark as false positive — future scans ignore it.
Auto-scheduler
A new site queued every 5 minutes. Max 2 parallel scans per server, hard timeout 30 min. Sites with prior findings are prioritised.
Live ticker instead of waiting
Files-scanned / total, threats found and clean files update live while the scan runs. Window can be closed — scan continues in the background.
What the scan checks
- PHP webshells (b374k, c99, r57, WSO, FilesMan, hexshell)
- Backdoors in PHP, Perl, Python
- Obfuscated code: eval+base64, gzinflate, str_rot13
- PHP mailer hijacks and spam-bot scripts
- Modified WordPress, Joomla and PrestaShop core files
- Cryptominer droppers and JavaScript injections
- Malicious URLs via URLhaus feed (abuse.ch)
- Phishing templates via Sanesecurity blurl.ndb
- 22 active YARA rules for known CVE exploits
- File size 24 bytes to 25 MB, recursive in customer directory
FAQ
Which scan engine does the malware scanner use?
Linux Malware Detect and ClamAV work together, including Sanesecurity extensions and daily auto-updates — MD5 hashes, HEX patterns and YARA rules also catch structurally obfuscated malware. Instead of a marketing number, every scan shows the real coverage percentage, when virus definitions were last updated, and the list of skipped files including the reason.
What happens when an infected file is found?
It can be moved to quarantine with one click — a root-owned directory PHP has no read access to. Alternatively, mark it as a false positive and the scanner will ignore it going forward.
Does a scan slow down the running website?
No. Scans run at low I/O priority (nice 19, ionice 6) and don’t disturb live traffic; a live progress ticker shows status, and the window can be closed without stopping the scan.
Do I have to scan every website manually?
No, scheduled scans run automatically — a new website joins the queue every 5 minutes (max 2 parallel scans per server), and websites with already-known findings are prioritized.
Scan every customer website automatically.
14-day free trial · No credit card · Made in Germany
View pricing →