Deep local scanning
Review files, database persistence, suspicious cron activity and administrator records.
Find, explain, recover
Investigate persistence without blind deletion.
Nexus scans files, database content, cron activity and administrator state, then supports evidence review, quarantine, repair, restore and controlled recovery.
File and DB scanningHidden admin detectionQuarantine VaultSafe repair
SCANNER & RESCUEBASELINE READY
File evidenceSuspicious execution pattern
PersistenceHidden administrator capability found
RecoveryRestore point preserved
Evidence before action
Open matched context, source path and supporting metadata before deciding.
Reversible recovery
Quarantine, restore points and repair workflows reduce the risk of destructive cleanup.
Real persistence coverage
Malware is not always a suspicious PHP file.
A compromise can persist through database options, user capabilities, cron tasks, modified packages or hidden administrators. Nexus brings these surfaces into one investigation and recovery workflow.
- Changed-file-first and full scan modes
- File, database, cron and administrator persistence checks
- Evidence snippets and known false-positive safeguards
- Quarantine, rollback, core repair and repository comparison
Capability map
Detection and recovery in the same workflow.
Scanner results remain connected to the evidence and the actions capable of reversing a mistake.
File and database scanning
Evaluate executable files, suspicious content, injected options and database persistence indicators.
- Signature and heuristic context
- Changed-file prioritization
- Database evidence
Hidden administrator discovery
Inspect user capability data directly for privileged accounts that filters or injected code may try to hide.
- Capability-row inspection
- Known persistence families
- Role evidence
Cron and persistence review
Identify suspicious scheduled tasks and repeated persistence mechanisms around the site.
- Cron inventory
- Suspicious callbacks
- Timeline context
Rescue Center
Quarantine files, preserve restore points, compare official sources and roll back controlled actions.
- Evidence viewer
- Core repair
- Quarantine restore
Operational flow
Detect → review → contain → verify.
The safest action depends on the component, evidence and availability of a trusted source.
Scan
Nexus evaluates the selected file, database, cron and administrator surfaces.
Review
The administrator opens the evidence, component context and source comparison.
Recover
Quarantine, repair, restore or manual remediation is chosen deliberately.
Verify
A follow-up scan confirms whether the evidence and persistence were removed.
Make cleanup reviewable and reversible.
- Preserve evidence before destructive action
- Create restore points for controlled changes
- Use official sources where available
- Treat custom/private components with context
Delete first and investigate later.
- Remove files solely from a filename match
- Call every vendor API client malware
- Repair custom code from an unrelated repository
- Erase historical evidence after cleanup
Feature questions
What buyers usually want to know.
Does Nexus automatically delete every malware match?
No. The workflow emphasizes evidence, quarantine and controlled recovery. Automatic destructive behavior is deliberately limited.
Can it scan the database?
Yes. Database persistence and suspicious option or content patterns are part of the scanner workflow.
Can it find hidden administrators?
It includes direct administrator and capability inspection for known persistence behavior that normal user listings may not reveal.
Does repository comparison work for premium plugins?
Official comparison is strongest for components with a trusted accessible source. Premium and custom components require a local baseline or manual context and are not automatically treated as malicious.
Lumiverse Nexus PRO
Recovery should leave you with evidence—not regret.
The Malware Scanner and Rescue Center are included in Nexus PRO.