Use the Malware Scan finding list to direct an investigation, not as an instruction to delete every matching file. Legitimate code can match a heuristic, and malicious code can avoid the supplied patterns.

Read each indicator

1. Open PD Modules → Guard → Malware Scan with Pro active.
2. Check the saved scan time and coverage warnings.
3. Review Severity, Indicator, File, Location and Line for the relevant row.
4. Use the search, severity/location filters and page controls to inspect the retained results.

The list retains up to 300 findings. High/medium totals count matching indicators, not necessarily unique files, and some counted matches can be outside the retained rows. A high-severity match can require investigation even when another label or location looks familiar.

Confirm provenance and context

Compare the affected file with the update, customisation or package you expected, using your authorised maintenance process. Cross-check File Integrity if a trustworthy earlier baseline exists. A new or changed fingerprint is evidence of a difference, not automatic proof of malware; an unchanged fingerprint only means it matches the baseline you accepted.

Location is a path-based classification rather than proof that a vendor supplied the file or that a match is harmless. Do not dismiss a finding solely because it is labelled as platform code, or delete a required file merely because it is under Your files.

Resolve and recheck

Preserve investigation evidence before an authorised repair or recovery. After addressing the verified issue, run the relevant checks again and review their timestamps and completeness. Do not replace a baseline just to make an unexplained difference disappear.

Retain the indicator, severity, scan time and a redacted file reference while your team investigates. Avoid pasting executable samples, private source code, credentials or full internal paths into ordinary support messages.

See the PD Guard Blesta guide for related tasks, or explore PD Guard.