Malware Scanner

The Malware Scanner analyses your Joomla file system for known malware patterns and suspicious code. The page is divided into an action bar, an active-configuration summary, scan metrics and a results table.

Malware Scanner action bar with Deep Scan and Submission type chips

Active configuration

Three chips beneath the action bar summarise the settings currently in effect (configured under Global Configuration › Malware Scanner):

  • Deep Scan status — when enabled, the scanner also searches for suspicious keywords that can appear in legitimate code. This increases detection coverage but also produces a higher number of false positives. Disabled by default.
  • Submission type — determines how suspicious files are sent to the OPSWAT Metadefender Cloud service. Hashes (default) submits only the cryptographic fingerprint of each file against a database of millions of known malware signatures — fast, and consumes fewer API calls. Files sends the complete file for analysis by more than 40 commercial anti-malware engines — more thorough but slower, and limited to 25 files per day on the free API key.
  • Timeline — restricts the scan to files created or modified within a given period: Yesterday, A week ago (default), A month ago, or Anytime. Narrowing the timeline reduces scan duration significantly.

Running a scan

Click Start in the action bar to begin. The status badge on the left changes to In Progress (blue) while the scan is running. Do not navigate away from this page while a scan is active.

Once the scan finishes the badge returns to Idle and a View Log button appears. Click it to open the full scan log in a modal window; you can also download the log from that modal.

The Configure button (⚙) takes you directly to the Malware Scanner tab in Global Configuration.

The scanner must read every file in your Joomla installation individually. A standard installation contains several thousand files, so a full scan — especially with Timeline: Anytime — can take considerable time and place significant load on the server. Run scans during periods of low activity.

If your PHP memory_limit directive is set to 128 MB or less, a warning badge is displayed before your first scan. Low memory can cause a blank page or make your site temporarily inaccessible. See the Troubleshooting section if this occurs.

Scan metrics

After the first scan completes, four summary cards are shown:

Card Description
Analyzed files Total number of files inspected in the last scan
Suspicious files Files that matched one or more malware patterns (shown in red when > 0)
High alert Subset of suspicious files rated at the highest alert level (shown in red when > 0)
Time taken Duration of the last completed scan

Before the first scan, a prompt card is shown instead, inviting you to run your first analysis.

Malware scan results

Suspicious files (default view)

The results table lists every file that matched a malware pattern. Each row contains:

  • Name — full path of the file. A Moved to quarantine badge is shown if the file has already been quarantined.
  • Alert level — severity of the match:
    • High (red badge) — strong pattern match; the file warrants close attention even if the OPSWAT online check reports it as clean. Obfuscated or encoded malware is frequently not detected by automated engines.
    • Medium (yellow badge) — pattern match with moderate confidence.
    • Low (grey badge) — weak or informational match; often a false positive.
  • Detection — the name of the matched pattern and a short description.
  • Online Check — result of the OPSWAT online verification (see below). Possible values: Clean, Infected, Suspicious, Failed to scan, Cleaned, Unknown, Quarantined, Skipped clean, Skipped dirty, Exceeded depth, Not scanned, Aborted, Encrypted, Exceeded size, Exceeded file number, Hash not found, or Not checked (default until an online check is run).

An Alert Level: High file requires manual review regardless of what the online check returns. If you are unsure whether a file is malicious, request a manual analysis.

Action buttons (Suspicious view)

  • Add file(s) as exception — marks the selected files as trusted. They will be excluded from future scans and will appear under the In Exceptions List filter.
  • Metadefender Cloud Check (hashes) — available when submission type is Hashes and the daily limit has not been reached. Submits the hash of each selected file to OPSWAT for reputation lookup.
  • Metadefender Cloud Check (files) — available when submission type is Files and the daily limit has not been reached. Uploads the selected files for full multi-engine analysis.
  • View submissions — opens the OPSWAT submission log to review previous online check results.

OPSWAT API limits

Online verification requires a free OPSWAT API key (configured under Global Configuration › Malware Scanner). If no key is configured, an alert is shown and the online check buttons are hidden.

When a key is present, two counters are displayed:

  • Reputation API (dark badge) — remaining hash lookups; free keys allow up to 1,000 per day.
  • Prevention API (blue badge) — remaining file submissions; free keys allow up to 25 per day.

Limits reset 24 hours after the first call on a given day. When a limit is reached, the corresponding button is disabled and an alert is shown.

Every time a new scan is launched, all Online Check statuses reset to Not checked, even for files previously submitted to OPSWAT. This reflects the dynamic nature of the service: engine signatures are updated daily, so a file that was reported as clean today may be flagged tomorrow.

In Exceptions List

Select this filter to view files previously added as exceptions. The Delete file(s) as exception button removes the selected entries, making them eligible to be flagged again in future scans.

This filter requires the Include exceptions in database option to be enabled under Global Configuration › File Manager. If it is disabled, a notice is shown instead of the list.

Quarantined files

Select the Quarantined filter to manage files that have been moved to quarantine. Two buttons are available:

  • Restore file(s) — moves the selected files back to their original location.
  • Delete — permanently removes the selected files from disk.

Files are flagged as suspicious, not confirmed malicious. False positives do occur. Be certain a file is genuinely harmful before deleting it — removing a legitimate file can break your site.

Three directories (and all files and subdirectories within them) are excluded from scanning by default: /tmp, /logs and /cache.

Disclaimer

A collapsible About these results & OPSWAT disclaimer section at the bottom of the page explains the limitations of pattern-based detection, the role of the OPSWAT Metadefender Cloud service, and the recommended course of action when a file is rated as High alert.