# Scans

> Full server scans, scheduled scans, per-account scans and CPU limits in Pyxsoft Antimalware.

Source: https://www.pyxsoft.com/docs/anti-malware/pyxsoft-global-scanner
Updated: 2026-11-10

---

Besides the [real-time scanner](./pyxsoft-instant-scanner), Pyxsoft Antimalware scans every account on a schedule, and you can start a scan of the whole server or of single accounts whenever you want. Scans apply the same [automatic actions](./pyxsoft-antimalware-settings#automatic-actions) as the real-time scanner.

## Full server scan

The **Scans** tab shows the last full scan, the schedule and how long the last full scans took. Click **Scan now** to start one.

![Scans tab: the full server scan card with the Scan now button, the scheduled scan card set to every Sunday at 00:50 with the CPU limited to 100%, and a bar chart with the duration of the last full scans](https://www.pyxsoft.com/_astro/am-scans.BQDQVzyC.png)

While a scan runs, the card shows the progress, the account being scanned, the files scanned, the speed, the CPU the service is using and what has been found so far. **Stop** ends it.

![A full server scan in progress: 20% done, web folder 2 of 7, 24,716 files scanned at 1,765 files per second, 71% CPU with a 100% limit, and one detection listed under "Found so far"](https://www.pyxsoft.com/_astro/am-scan-running.D2r54MFo.png)

When a scan ends with suspicious files, it can wait up to 3 minutes for Pyxsoft Labs to review them, so the scan finishes with the final result. Click **Don't wait** to end it right away; anything Labs confirms later still shows up in [Detections](./pyxsoft-antimalware-detections).

Files that haven't changed since they were last scanned are not analyzed again, so a repeated scan of the same server finishes much faster than the first one.

## Scheduled scan

Click **Change schedule** (or go to **Settings → Scheduled scan**) to choose the days and the time of the full scan. The time is the server's time. With no days selected, the scheduled scan is off.

![Scheduled scan settings: day buttons from Monday to Sunday with Sunday selected, the time set to 12:50 AM, and the summary "Every Sunday at 00:50 (server time)"](https://www.pyxsoft.com/_astro/am-settings-schedule.Qfz1UXyh.png)

## CPU limit

Scans run with a CPU limit so the sites on the server don't slow down. Set it in **Settings → Performance**. 100% is one core, as `top` shows it.

![Performance settings: the CPU limit selector with 25%, 50%, 100% and No limit, set to 100%](https://www.pyxsoft.com/_astro/am-settings-performance.Cz7pzNPh.png)

| Limit | Effect |
|-------|--------|
| 25 % / 50 % | Slower scan, lower impact on the server |
| 100 % (default) | Balanced speed and impact |
| No limit | Uses several cores (`top` may show 400% or more): the fastest scan, with the highest impact |

The limit applies to global and account scans from the next scan on. The real-time scanner is not affected: it only scans files as they change.

## Scanning accounts

The **Accounts** tab lists every cPanel account with its reseller, its state (clean, with detections, never scanned or excluded) and when it was last scanned.

![Accounts tab: a table of seven cPanel accounts with their main domain, reseller, state "Clean", last scan "3 days ago, server scan" and a Scan button on each row](https://www.pyxsoft.com/_astro/am-accounts.kC_ZTDRo.png)

- **Scan** on a row scans that account right away.
- Select several accounts and click **Scan selected** to queue them; they are scanned one after another.
- An account with detections links to its detections.
- An account [excluded in Settings](./pyxsoft-antimalware-settings#exclusions) is skipped by the full scan, but scanning it by hand still scans it.

Account scans are not available while a full server scan is running.

## History

The **History** list at the bottom of the Scans tab shows every scan with its type (scheduled or manual), scope, duration, files, detections and result. **Detections** on a row opens the detections that scan found. A scan marked *Failed* was interrupted because the service stopped or restarted during it.