Getting Started
Scanning mode#
The first think you need to decide is the strength, you need to calibrate your scan to find less false positive as possible during scanning but without miss real malware. For this you can choose the aggression level.
The scanner permit to have some predefined modes:
| Mode | Alias | 🚀 | Description |
|---|---|---|---|
| None (default) | 🔴 | Search for all functions, exploits and malware signs without any restrictions | |
| Only exploits | -e | 🟠 | Search only for exploits definitions Use flag: --only-exploits |
| Lite mode | -l | 🟡 | Search for exploits with some restrictions and malware signs (on Wordpress and others platform could detect less false positivity) Use flag: --lite |
| Only functions | -f | 🟡 | Search only for functions (on some obfuscated code functions couldn't be detected) Use flag: --only-functions |
| Only signatures | -s | 🟢 | Search only for malware signatures (could be a good solution for Wordpress and others platform to detect less false positivity) Use flag: --only-signatures |
Suggestions#
If you are running the scanner on a Wordpress project or other popular platform use --only-signatures or --lite flag
to have check with less false positive but this could miss some dangerous exploits like nano.
Examples:#
Detection Options#
When a malware is detected you will have the following choices (except when scanner is running in report
mode --report):
- Delete file
--auto-delete - Move to quarantine (move to
./scanner-quarantine)--auto-quarantine - Dry run evil code fixer (try to infected fix code and confirm after a visual check)
--auto-clean - Dry run evil line code fixer (try to fix infected code and confirm after a visual check)
--auto-clean-line - Open with vim (need
php -d disable_functions='') - Open with nano (need
php -d disable_functions='') - Add to whitelist (add to
./scanner-whitelist.json) - Show source
- Ignore
--auto-skip