Forensic, read-only malware and integrity scanner: heuristic web-shell detection, core-checksum verification, and a file-change baseline.