The anti-malware that finally finds everything.
No malware too small, too new or too hidden. It finds it, cleans it and keeps watching every account on the server.
$ curl -s https://www.pyxsoft.com/install-anti-malware | bashNo credit card needed. Runs on cPanel and on Debian and RHEL-based servers with no panel.
No detections to resolve
Last global scan 2 min. ago. The real-time scanner keeps watching.
58,730 files in 38 s
The real-time scanner checks each file in 51.6 ms on average.
Finds what has no signature yet
Files are flagged by what they do, before a signature exists.
- Global scan: 58,730 files, 1 detection2 min. ago
- wp-config.php cleaned (real time)arcadia, 5 min. ago
- invoice-8812.php quarantined (real time)bistro, 6 min. ago
- New signatures published1 hr. ago
The whole server in one screen.WHM shows what is protected, what the scanner found and what it did about it, without opening a terminal.
- Caught by the real-time scanner, 2:02 PM
- Cleaned automatically, 2:02 PM
- Account
- arcadia
- Size
- 3.1 KB
- Detected by
- Signature, in real time
- SHA-256
a106b3b3794f4644de878aea30f76ed1…
Cleaned, not deleted.Pyxsoft removes only the injected line and keeps the legitimate file, so the site stays up. One click puts the original back.
Nothing to review.
No panel? Run pyxsoft.The same scanner, detections and quarantine in a full-screen interface over SSH, with mouse and function keys.
Malware found and cleaned on server01
The real-time scanner found code injected into a file of the account arcadia. It removed the injection and kept the rest of the file, so the site stayed online.
- File
/home/arcadia/public_html/wp-config.php- Detection
- Injected code
- Action
- Cleaned automatically
- When
- Nov 10, 2026, 2:02 PM
To review it or put the original back, open WHM, then Plugins, then Pyxsoft Anti Malware.
This server has had 9 detections in the last 30 days. All of them are resolved.
You hear about it first.An email for every detection with what was found, where and what was done, even on servers with no panel.
Finds it. Cleans it. Never slows you down.
Web shells, backdoors, injected code and phishing kits, on every account of the server, including the ones nobody has seen before.
Finds it all
New, obfuscated or a few bytes long. It reads code the way PHP does, so a file doesn't need a known signature to get caught. Phishing kits are recognized too, even inside a .zip, with the directory where the kit was installed.
Real-time and on demand
Every file is checked the moment it lands on disk, whether it came by FTP, an upload, an extracted archive or a script. Scan one account or the whole server whenever you want, or on a schedule.
Cleans it
Most scanners stop at quarantine. Pyxsoft removes the injected code and keeps the legitimate file, so the site stays up. Every clean can be undone.
Never slows you down
WordPress, 9,229 files
WordPress with 15 plugins, 30,466 files
How it finds what others miss
Three checks on every file. Each one covers what the one before it can't see.
- 1
Signatures
Known malware is matched by hash, by pattern and by the shape of the code once it is normalized, so renaming variables or adding junk doesn't hide it. New signatures arrive every 6 hours.
- 2
Analysis of the code
The scanner parses each PHP file and follows what it does: input from a visitor that ends up executed, decoded payloads, hidden loaders. That catches malware no one has written a signature for yet.
- 3
Re-checks after every update
When signatures change, files that were flagged as suspicious are checked again, so a file that looked odd yesterday can be confirmed as malware today, without a new scan.
Files that haven't changed since the last check are not read again, which is why repeat scans take a fraction of a second.
Removes the infection, keeps the site
Attackers inject a line into wp-config.php, index.php or a plugin file. Deleting the file takes the site down. Pyxsoft takes out only what was injected.
- Only the injected code goesEvery injection a signature finds in the file is removed in one pass. The rest of the file stays as it was.
- One click to undoThe original is kept. Restore original puts it back exactly as it was found.
- Whole files of malware are isolatedA web shell or a dropper has nothing to keep, so it goes to the quarantine, encrypted and out of the accounts.
- You decide how far it goesQuarantine, delete or only report, set separately for known malware and for suspicious files, with Auto Clean on or off.
Manage it from WHM or from the terminal
The same protection, whether your servers run cPanel or no panel at all.
- OverviewWhat needs attention, real-time status, the last and next scan, and 30 days of detections.
- Detections and accountsFilter by account, kind or status, see the file with the reason it was flagged, and export to CSV or JSON.
- Scans, quarantine and allowlistScan the server or one account, restore a false positive, and see which allowed files changed since.
- SettingsAutomatic actions, exclusions, schedule, CPU limit and alert emails.
Run pyxsoft over SSH for a full-screen interface with menus, mouse and function keys, or use its commands in your own scripts.
Alert emails
An email for every real-time detection, a summary after each scan that finds something, and an optional monthly report.
Symlink protection
Links from an account to system files or to other accounts are detected and removed, so one account can't read another.
Reinfection warnings
An account with detections on several days is flagged, because it usually means the hole that let the attacker in is still open.
Where it runs
One installer for every supported system. It detects the distribution and the panel by itself.
Cleaning is half the job. pxShield keeps it from coming back.
Sites get reinfected through the hole that let the attacker in. pxShield blocks those attacks before they reach your web server. Together they are Pyxsoft Suite, under one license code.
Costs less than buying both, and adds pxShield for a few euros more than Anti Malware alone. See the price in your currency
One price per server. Every feature included.
Unlimited sites and accounts, and a 7-day free trial without a credit card. Prices come straight from our checkout, in your currency.
Finds and cleans malware on every account, in real time and on demand.
Anti Malware and pxShield under one license code.
The WAF for Apache, nginx and Caddy, with a dashboard for every customer.
Using CorePanel? pxShield is already included.
Prices for your location. Taxes are calculated at checkout by Paddle, our merchant of record.
More than 50 servers? Talk to sales
Questions
Anything else? Talk to us or read the documentation.
Will it slow down my server?
Scans run under a CPU limit you set in WHM, and the limit holds on small servers too. With the default of one core, a WordPress site of 9,229 files takes 12 seconds the first time and half a second after that, because files that haven't changed are not read again. At rest the service uses about 0.3% CPU.
What if it cleans or quarantines something legitimate?
Every action can be undone. A cleaned file keeps a copy of the original and Restore original puts it back. A quarantined file can be restored from the quarantine, which also adds it to the allowlist so scans leave it alone.
Does it work without cPanel?
Yes. On Debian and RHEL-based servers with no panel it protects the sites of your web server, and you manage it with the pyxsoft command or its full-screen interface over SSH. Alert emails work the same way.
How are signatures updated?
The service checks for new signatures every 6 hours and loads them without a restart. Files that are new or have changed are checked against them right away. Malware with no signature yet is caught by the analysis of the code.
Where do quarantined files go?
Out of the accounts, encrypted, to a place where they cannot run or be served. You can view, restore or delete each one from WHM or from the terminal.
What happens when the free trial ends?
Buy a license and enter the code in WHM or with pyxsoft license set. Without a valid license, real-time protection and scheduled scans stop and you get an email, so nothing stops silently.
Scan your server today.
One command. Free for 7 days, no credit card.
$ curl -s https://www.pyxsoft.com/install-anti-malware | bash