1#@!#!123s

: / home / shubmkcj /
Filename : scanreport-shubmkcj-Dec_13_2022_13h08m.txt
back
----------- SCAN REPORT -----------
TimeStamp: Tue, 13 Dec 2022 13:08:02 -0500
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 50000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/shubmkcj/scanreport-shubmkcj-Dec_13_2022_13h08m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user shubmkcj --virusscan --vmrssmax 2000000 --xtra /etc/cxs/cxs.xtra.manual)


Scanning /home/shubmkcj:

'/home/shubmkcj/access-logs'
# Symlink to [/etc/apache2/logs/domlogs/shubmkcj]

'/home/shubmkcj/.nc_plugin/hidden'
# World writeable directory

'/home/shubmkcj/ancientaura.in/function.php'
# Universal decode regex match = [universal decoder]
# Scan Timeout (30 secs) while processing:
'/home/shubmkcj/designpitara.com/admin/admin.zip'

'/home/shubmkcj/designpitara.com/admin/blogs/blogs-files/en_bypass403.php'
# Decode regex match = [decode regex: 1]

'/home/shubmkcj/designpitara.com/admin/ckeditor/plugins/codesnippetgeshi/dev/geshi/geshi/pic16.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/shubmkcj/designpitara.com/image/function.php'
# Universal decode regex match = [universal decoder]

'/home/shubmkcj/digitalvcards.org/include/facebook/Authentication'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/Exceptions'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/FileUpload'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/GraphNodes'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/Helpers'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/Http'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/HttpClients'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/HttpClients/certs'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/PersistentData'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/PseudoRandomString'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/facebook/Url'
# World writeable directory

'/home/shubmkcj/digitalvcards.org/include/google/vendor/phpseclib/phpseclib/travis/setup-secure-shell.sh'
# Regular expression match = [\n(?!\s*(//|\#|\*)).*\.ssh/]

'/home/shubmkcj/logs/monitadhingra.shubhariya.com-ssl_log-Dec-2022.gz'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/logs/monitadhingra.shubhariya.com-ssl_log-Nov-2022.gz'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/logs/praneshaswalphotography.shubhariya.com-ssl_log-Nov-2022.gz'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/logs/rkhconsultant.shubhariya.com-ssl_log-Dec-2022.gz'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/logs/simmiguptaphotography.com.shubhariya.com-ssl_log-Dec-2022.gz'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/logs/urbane.createerp.com-Dec-2022.gz'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/logs/urbane.createerp.com-ssl_log-Dec-2022.gz'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/mail/designpitara.com/contact/.spam/new/1637225860.M25307P717473.premium140.web-hosting.com,S=439417,W=445477'
# ClamAV detected virus = [Win.Dropper.LokiBot-9924320-0]

'/home/shubmkcj/mail/designpitara.com/contact/.spam/new/1643192001.M253690P3914855.premium140.web-hosting.com,S=833454,W=844898'
# ClamAV detected virus = [Win.Packed.Malwarex-9937660-0]

'/home/shubmkcj/mail/designpitara.com/contact/.spam/new/1644218778.M809322P3454955.premium140.web-hosting.com,S=583381,W=591415'
# ClamAV detected virus = [Win.Trojan.EmbeddedDotNetBinary-9940868-0]

'/home/shubmkcj/mail/designpitara.com/contact/.spam/new/1655452340.M888769P471788.premium140.web-hosting.com,S=458662,W=465015'
# ClamAV detected virus = [Win.Dropper.Lokibot-9953187-1]

'/home/shubmkcj/mail/designpitara.com/contact/.spam/new/1656654710.M73032P1778242.premium140.web-hosting.com,S=468385,W=474831'
# ClamAV detected virus = [Doc.Downloader.Redline-9972754-0]

'/home/shubmkcj/mail/designpitara.com/contact/.spam/new/1660110606.M35842P669761.premium140.web-hosting.com,S=1017501,W=1031475'
# ClamAV detected virus = [Win.Dropper.Nanocore-9967048-0]

'/home/shubmkcj/mail/designpitara.com/contact/.spam/new/1661245936.M715648P1451839.premium140.web-hosting.com,S=24249,W=24658'
# ClamAV detected virus = [Doc.Downloader.Redline-9972754-0]

'/home/shubmkcj/mail/designpitara.com/contact/.spam/new/1662616358.M279385P1637436.premium140.web-hosting.com,S=66832,W=67797'
# ClamAV detected virus = [Doc.Downloader.Redline-9972754-0]
# Scan Timeout (30 secs) while processing:
'/home/shubmkcj/mail/designpitara.com/dk/cur/1641815994.M939773P3377261.premium140.web-hosting.com,S=9868828,W=10004108:2,S'
# Scan Timeout (30 secs) while processing:
'/home/shubmkcj/mail/designpitara.com/ravindra/cur/1632401178.M187177P3241016.premium140.web-hosting.com,S=21001535,W=21274305:2,S'
# Scan Timeout (30 secs) while processing:
'/home/shubmkcj/mail/designpitara.com/ravindra/cur/1632806187.M654039P2275460.premium140.web-hosting.com,S=21019131,W=21292130:2,S'

'/home/shubmkcj/praneshaswalphotography.com/images/arrows.png'
# Suspicious image file (hidden script file)

'/home/shubmkcj/simmiguptaphotography.com/admin/images/priv.php'
# Decode regex match = [decode regex: 1]

'/home/shubmkcj/tmp/1.php'
# Known exploit = [Fingerprint Match] [PHP Shell Exploit [P1969]]

'/home/shubmkcj/tmp/awstats/ssl/awstats062021.designpitara.shubhariya.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats092022.monitadhingra.shubhariya.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats102021.monitadhingra.shubhariya.com.txt'
# ClamAV detected virus = [YARA.eval_post.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats112021.designpitara.shubhariya.com.txt'
# ClamAV detected virus = [YARA.eval_post.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats112022.monitadhingra.shubhariya.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats112022.praneshaswalphotography.shubhariya.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats122022.monitadhingra.shubhariya.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats122022.rkhconsultant.shubhariya.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats122022.simmiguptaphotography.com.shubhariya.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

'/home/shubmkcj/tmp/awstats/ssl/awstats122022.urbane.createerp.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.585.UNOFFICIAL]

----------- SCAN SUMMARY -----------
Scanned directories: 4006
Scanned files: 61454
Ignored items: 845
Suspicious matches: 46
Viruses found: 25
Fingerprint matches: 1
Data scanned: 10470.06 MB
Scan peak memory: 307496 kB
Scan time/item: 0.051 sec
Scan time: 3325.749 sec