Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is Malware Scanning?

Definition

Malware scanning is the automated inspection of files, email, devices, or websites for malicious code, usually by matching known signatures and suspicious behavior. It catches much of the known malware, but a clean scan does not prove a system is clean, because new and customized malware is built to slip past scanners.

How It Works

NIST SP 800-83 Revision 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, describes the core scanning modes for antivirus software:

  • On-access scanning: real-time scans of each file "as it is downloaded, opened, or executed."
  • On-demand scanning: full or targeted scans launched on a schedule or by a user.
  • Email and removable media: attachments and USB drives scanned before use.

NIST stresses that antivirus is only as good as its signatures, so updates must be automatic and current. It also warns that when attackers send a unique variant to each victim, "largely signature-based security controls, such as antivirus software, cannot keep up," and recommends defense in depth: several detection methods, so at least one catches the behavior.

Websites add two more types:

  • Remote (external) scanners load your pages like a visitor and look for injected scripts, spam, and blocklist status. They cannot see server-side files.
  • Server-side scanners read the files and database on the host, where backdoors and webshells actually live.

Real-World Example

Sucuri's 2023 Hacked Website and Malware Threat Report describes VexTrio redirect malware, found on 8.04% of the infected websites its team remediated that year. The malware injected obfuscated PHP inclusions into core WordPress files, and the included files "usually have extensions that do not associate with executable code, which helps attackers avoid detections by scanners that focus only on PHP, JS, or HTML files." The loaded code then fetched a redirect domain from a remote server and sent visitors to scam sites. A scanner that only checked familiar file types would have reported these sites as clean.

Why It Matters for a Small Business

Scanning is cheap, and it catches the large volume of commodity malware that hits small businesses. The danger is false confidence. Verizon's 2026 Data Breach Investigations Report found that, among ransomware cases where the victim's size was known, about 96% of victims were small and medium businesses, and that these victims were often hit because they had compromised credentials (38%) or unpatched vulnerabilities in edge devices (29%), neither of which a malware scan detects. A website that passes a remote scan can still hold a backdoor in its database or uploads folder. Scanning needs to cover both endpoints and servers, and its results need someone to review them.

How to Spot It / How DTS Handles It

Gaps to check: antivirus with expired signatures or disabled real-time protection, a website checked only by an external scanner, scan alerts nobody reads, and "clean" results on a site that still redirects visitors.

For websites, DTS runs automated server-side scans of files and databases alongside external checks, plus wp core verify-checksums and wp plugin verify-checksums, and a person reviews the alerts. For office devices, DTS can help with setting up and reviewing endpoint scanning. See our WordPress care plans, and for office devices, our managed IT service.

Related Terms

  • Malware: what scanners are looking for.
  • File integrity monitoring: catches changes that signatures miss.
  • EDR: behavior-based detection beyond traditional antivirus.
  • Malicious redirect: the VexTrio example's payload.
  • Webshell: server-side malware that remote scans cannot see.
  • False positive: a clean file flagged as malicious.

Sources

  • NIST, SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops (2013): https://csrc.nist.gov/pubs/sp/800/83/r1/final
  • Sucuri, 2023 Hacked Website & Malware Threat Report (vendor research): https://sucuri.net/reports/2023-hacked-website-report/
  • Verizon, 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/Tf3/reports/2026-dbir-data-breach-investigations-report.pdf

Last updated October 14, 2026.