Offline malware / script scanner for webfiles (PHP and HTML) [closed]

Question

I have downloaded an entire copy of a website that has been used as a spam relay. I think I have tracked down the problem to a loophole in a contact form (now closed, but was not used, but still accessible hence why it was missed), however I would like to check the website files for injected code.

Will a standard anti virus such as BitDefender do the job, or can anyone recommend a scanner (preferably standalone) that can scan PHP files and find known injections.

Thanks in advance for any answers

Answer 1

No, malicious code in your PHP file is not a virus or a trojan. Most end user anti-malware tools do not scan for these types of things.

The malicious actions in your web app may be legitimate commands that make sense in a different context. You may want to look into static code analysis tools which analyze code for software design errors.