Intro
PHP Antimalware Scanner
PHP Antimalware Scanner is a free tool to scan PHP files and analyze your project to find any malicious code inside it.
It provides an interactive text terminal console interface to scan a file, or all files in a given directory, and find PHP code files that seem to contain malicious code. When a probable malware is detected, will be asked what action to take (like add to whitelist, delete files, try clean infected code etc...).
The package can also scan the PHP files in a report mode, so without interact and outputting anything to the terminal console. In that case the results will be stored in a report file in html (default) or text format.
This scanner can work on your own php projects and on a lot of others platform using the right combinations of configurations (ex. using lite flag can help to find less false positivity).
WordPress administration
The Antimalware Scanner WordPress plugin provides scheduled scans, reports, quarantine and whitelist management, and controlled remediation from the WordPress dashboard. Its settings use collapsible panes while keeping Scan policy visible. Browser edits show a server-generated diff and PHP syntax result before confirmation, then rescan the saved file before resolving its finding. Responsibility and backup warnings appear when automatic file actions are enabled or saved and before report remediation or quarantine restore and deletion. The admin dashboard widget starts scans without leaving the page, shows live progress while they run, and summarizes the latest scan, unresolved detections, malware detected, and quarantined files with a direct link to the latest report. Open Antimalware > About to check the installed plugin and engine versions or find project documentation, support, contribution guidance, licensing, and contributor credits. See the WordPress plugin guide for installation and dashboard workflows.
Remember that you will be solely responsible for any damage to your computer system or loss of data that results from such activities. You are solely responsible to adequate protection and backup of the data before execute the scanner.
How it works
It checks for all lines of code on every file of the given directory for Dangerous functions, Exploits and ** Signatures**. When a probable malware is detected, will be asked what action to take, or it'll just print on your report file.
Dangerous functions
Dangerous functions are php functions that could damage your system. As example system or shell_exec could execute
malicious native code on your environment.
Signatures
Signatures are specific patterns that allows to recognize malicious threats, such as a known malicious instruction sequences used by families of malware.
Exploits
Exploits are very similar to signatures but have a more common pattern and for this they can find false positives much more easily. So often they are reported as a warning to the user rather than a certain malware.