Vinza Scanner is a control plane in Python over a compiled Go engine that does the actual file scanning. It detects malware three ways: exact-file matching against SHA-256 hashes, content signatures for webshells, backdoors and miners, and hashes pulled from a central feed. You can upload your own virus sample — the bytes are hashed and discarded, not stored — and any file matching that digest is flagged from then on.

Scans run on demand against a path, optionally moving hits straight to quarantine at /var/quarantine/vinza-scanner. Real-time coverage comes from a separate inotify watcher that install.sh registers as a root systemd unit (vinza-scanner-watch); the plugin can start, stop, restart it and set the directories it watches, but the watcher is a single global service, so those controls and the shared quarantine are admin-only. A regular user may scan inside their own home directory — the path is symlink-resolved first, so a link cannot be used to step outside it — and sees only detections that fall within that home.

Signature syncing pulls a feed from VinzaWeb and verifies its RSA signature against the packaged trust key before writing anything to the engine's store; an unsigned or badly signed feed is refused outright. Hashes you upload are also submitted upstream for review as a best-effort contribution, which needs an active licence and quietly no-ops without one. Service control goes through the root agent, since the panel user cannot drive systemd. If the Go binary was never built, the plugin reports that and does nothing else.

A scheduled full scan can run daily or weekly from a root cron entry, its detections alerted like the watcher's. False positives go on an ignore list — a file by path and SHA-256, so any change to it is scanned again, or a signature everywhere — which the engine honours in every scan.

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Paid license required

Permissions

files.view

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.0.5 — The page is organised in tabs: Scan, Detections, Quarantine, Protection (real-time watch and schedule), Signatures and Ignore list; the stat tiles open their tab and the open tab is kept in the URL. Every list is paged at 15 items with filters: detections by text, severity (chips with counts), source and quarantine status, filtered and paged on the server over the latest 5,000; quarantine by text and restorability; uploaded samples by text and severity; the ignore list by text and type; a long scan result by text and severity. Polling only refreshes the list you are looking at. 1.0.4 — Scheduled full scans (daily or weekly at a chosen hour) run by the engine as root from cron; what they find is alerted like the watcher's detections. Ignore list for false positives: a file by path and SHA-256 (scanned again as soon as it changes) or a signature everywhere, honoured by scans, the watcher and scheduled scans, with ignore buttons on each detection. 1.0.3 — Restore a quarantined file to its original path, owner and mode (never overwrites an existing file; only into account homes or /var/www); the engine now records where each quarantined file came from, and a restored file is not re-quarantined while unchanged. Detections raise one alert per scan or watcher batch (bell, plus the admin's email/Telegram/webhook on panel 1.3.78+; tenants are alerted for their own sites). 1.0.2 — Updating no longer fails while the watcher runs (Text file busy). Accounts without a Linux user get no home scope. Security: names shown in the page (from the server, its sites or its users) are passed to buttons safely; a quote in one could run script in the admin's browser. 1.0.1 — Fixed a false positive that quarantined WordPress core wp-includes/kses.php within seconds (breaking WordPress installs and sites): the preg_replace /e rule now only matches a real /e pattern argument. Detections found by the real-time watcher now show on the page (the log file was root-only). 1.0.0: Initial release. Go-native engine, real-time inotify watcher (systemd), upload-sample SHA-256 detection, content signatures, quarantine.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/vinza-scanner/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "vinza-scanner",
  "version": "1.0.5",
  "download_url": "..."
}