Multi/Others scan backdoors - WebShield GUI (1 Viewer)

[m.z102030]

​

1. Modes (top dropdown)
   • Sanitize → Suspicious code is commented out or neutralized instead of fully deleting the file.
   • Quarantine → Suspicious files are moved to a quarantine folder (safe zone).
   • Delete → Suspicious files are permanently removed.
   • Warn Only → No changes are made, the tool only reports issues.

---

1. Options (checkboxes & inputs)
   • Auto-apply during scan → Automatically apply the selected action as files are detected.
   • Dry-run (no destructive action) → Simulation mode. The tool only reports results but makes no actual changes. (Safe for first scans).
   • Extensions (comma or * for all) → Choose which file types to scan (e.g., *.php, *.js or * for all).
   • Exclude dirs (comma) → Skip certain directories (e.g., .git, node_modules).
   • Protect extensions → Files with extensions like .jpg, .png, .css, .woff will never be deleted or modified unless Force is checked.
   • Force modify protected files → Even protected files can be changed (use with caution).

---

1. Main Buttons
   • Select Folder → Choose the folder to scan (e.g., your project).
   • Scan / Stop → Start or stop the scanning process.
   • Apply action to selected → Apply the chosen mode (Sanitize/Quarantine/Delete) to only the highlighted rows in the results table.
   • Open Quarantine → Opens the quarantine folder where suspicious files are stored.
   • Restore All (manifest) → Restore files from quarantine based on the saved manifest.
   • Open Backups → Open backup copies of cleaned/modified files.
   • Export CSV → Export the scan report as a .csv file for external review.
   • Exit → Close the program.

---

1. Results Table
   • File → The full path of the scanned file.
   • Patterns → The suspicious code pattern found (e.g., eval(, exec().
   • Protected → Whether the file is protected by extension rules.
   • Action → The suggested action (sanitize, quarantine, delete, warn).
   • Applied → Shows if the action has been applied yet.

---

1. Status Bar (bottom)
   • Shows progress, number of files scanned, and how many suspicious matches were found.
   • Example: Done. Scanned 8703 files. Found 48.

---

Typical Workflow:

1. Run a scan with Dry-run ON → review results.
2. Switch to Sanitize or Quarantine → Apply action to suspicious files.
3. If satisfied, use Delete only for confirmed backdoors.
4. Export CSV report for record-keeping.
5. Use Open Backups / Quarantine if you need to restore files.

Download:

To view the content, you need to Sign In or Register.

Click to read more...

 

[edward0666]

Thanks