Docs / Security / Malware Scanner

Malware Scanner

Panelica 1.0.375 Verified 2026-07-24 Security

The Malware Scanner is Panelica's purpose-built defense against hacked websites: the obfuscated PHP web shells, backdoors and injected code that signature-based antivirus misses because they are brand new or one-off. It is a separate engine from Antivirus with its own multi-layer detection, confidence scoring and CMS integrity checking.

Panel locationSecurity → Malware Scannerhttps://YOUR-SERVER-IP:8443/security/malware-scanner

Malware Scanner

Dashboard Findings Signatures CMS Integrity

malicious wp-content/uploads/x.php98% · web shell

How it detects the undetectable

Signature antivirus asks "have I seen this exact file before?". A fresh web shell fails that test. The Malware Scanner instead asks "does this file behave like malware?", across several independent layers, and combines them into a confidence score.

Layer	What it looks for
Hash	Exact matches against known-bad signatures
Pattern	Over a hundred rules for known web-shell and backdoor code
Obfuscation	Encoded, hex-escaped or concatenated code hiding its intent
Entropy	Statistically random-looking blocks that signal packed/encrypted payloads
Behavioral	Dangerous behavior: file-inclusion, reading `/etc/shadow` or SSH keys, password-gated shells, self-modifying files

Behind the scenes: each layer contributes to a confidence score, and a file crossing the higher threshold is flagged malicious, the lower one suspicious. A "known" layer adds certainty by cross-checking against the Linux Malware Detect database (known-bad) and official CMS checksums (known-good), so a finding can be labeled confirmed-malicious, confirmed-clean or estimated. The engine is pure Panelica code; it does not rely on ClamAV, and its signatures update daily from public malware and CMS-checksum sources.

Scanning and findings

Four scan types: Quick, Full, Domain (scan a single site's document root, the go-to when one site is misbehaving) and Custom. Non-admin accounts are scoped to their own home. Scans run in the background with live progress.

The Findings tab is where you work: filter by classification, severity, layer, certainty or domain, and for each hit see the file, a confidence percentage, the layer that caught it, and its severity. Preview a suspect file to read it in place, then quarantine, delete, or whitelist it, individually or in bulk.

Cleaning a hacked site, in order: run a Domain scan on the affected site, sort findings by confidence, and start with the confirmed-malicious ones (a preview usually makes a web shell obvious). Quarantine rather than delete first, so you can restore if you misjudge. Then run CMS Integrity to catch modified core files, and only after the site is clean, rotate its passwords and database credentials, since the attacker likely had them.

CMS Integrity

The CMS Integrity tab compares your WordPress core files against the official published checksums and lists any files that have been modified or are missing, which is how injected code hiding inside a legitimate-looking core file gets caught. It is one of the fastest ways to confirm whether a WordPress install has been tampered with.

Signatures

You can add your own hash signatures (categorized as web shell, backdoor, cryptominer, dropper and so on) to teach the scanner about malware specific to your environment, on top of the automatically synced public sets.

Access

Behind the security.malware-scanner page permission; scans and findings are scoped by the roles and permissions chain, so an account only sees its own results. Signature management is limited to ROOT and ADMIN.

Panelica Documentation · Written and verified against the live panel. · Last verified 2026-07-24 on Panelica 1.0.375