Finding what should not be there.
IMUNIFYAV
cPanel > ImunifyAV. Scan the full home directory rather than just the website folder, since backdoors are frequently placed elsewhere.
Review the Malicious tab. Each detection shows the file and the signature matched.
APPLICATION-LEVEL SCANNERS
Many platforms have security plugins that compare core files against the official versions, which catches modified files that a signature scanner might miss.
Two different scanners find different things.
WHAT TO LOOK FOR MANUALLY
PHP files in upload directories Files modified at times nobody was working
Heavily obfuscated code: long base64 strings, functions assembled at runtime
Administrator accounts you did not create Cron jobs you did not add
ACTING ON FINDINGS
- Core files: replace with fresh official copies rather than editing
- Extensions: delete and reinstall from source
- Unknown files in uploads: safe to delete
- Anything uncertain: open a ticket before deleting, since removing the wrong file takes the site offline
Download a backup before deleting anything.
