0xn0l

📂 /home/usatwnzi

✎ EDIT: scanreport-usatwnzi-Dec_14_2022_07h43m.txt ← BACK

----------- SCAN REPORT -----------
TimeStamp: Wed, 14 Dec 2022 07:43:10 -0500
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 10000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/usatwnzi/scanreport-usatwnzi-Dec_14_2022_07h43m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user usatwnzi --virusscan --vmrssmax 2000000 --xtra /etc/cxs/cxs.xtra.manual)

Scanning /home/usatwnzi:

'/home/usatwnzi/access-logs'
# Symlink to [/etc/apache2/logs/domlogs/usatwnzi]

'/home/usatwnzi/.nc_plugin/hidden'
# World writeable directory

'/home/usatwnzi/logs/bbctribune.com-ssl_log.bkup'
# Symlink to [/etc/apache2/logs/domlogs/bbctribune.com-ssl_log.bkup]

'/home/usatwnzi/logs/bbctribune.com.bkup'
# Symlink to [/etc/apache2/logs/domlogs/bbctribune.com.bkup]

'/home/usatwnzi/logs/theamericanmail.bbctribune.com-ssl_log.bkup'
# Symlink to [/etc/apache2/logs/domlogs/theamericanmail.bbctribune.com-ssl_log.bkup]

'/home/usatwnzi/logs/theamericanmail.bbctribune.com.bkup'
# Symlink to [/etc/apache2/logs/domlogs/theamericanmail.bbctribune.com.bkup]

'/home/usatwnzi/logs/thenewshunt.bbctribune.com-ssl_log.bkup'
# Symlink to [/etc/apache2/logs/domlogs/thenewshunt.bbctribune.com-ssl_log.bkup]

'/home/usatwnzi/logs/thenewshunt.bbctribune.com.bkup'
# Symlink to [/etc/apache2/logs/domlogs/thenewshunt.bbctribune.com.bkup]

'/home/usatwnzi/public_html/admin.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/public_html/wp-admin/images/resize-6x.png'
# Suspicious image file (hidden script file)

'/home/usatwnzi/public_html/wp-admin/includes/admin.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/public_html/wp-admin/includes/wp-corn-sample.php'
# Universal decode regex match = [universal decoder]

'/home/usatwnzi/public_html/wp-content/plugins/paulworkspace/a.php'
# Known exploit = [Fingerprint Match] [PHP POST Exploit]

'/home/usatwnzi/public_html/wp-content/plugins/paulworkspace/adminer.php'
# Regular expression match = [Adminer - Compact database management]

'/home/usatwnzi/public_html/wp-content/plugins/paulworkspace/alfa.php'
# Known exploit = [Fingerprint Match] [Hacker Sig Exploit [P1897]]

'/home/usatwnzi/public_html/wp-content/plugins/paulworkspace/cook.php'
# Known exploit = [Fingerprint Match] [PHP Obfuscator [P1646]]

'/home/usatwnzi/public_html/wp-content/plugins/paulworkspace/js.php'
# Known exploit = [Fingerprint Match] [PHP Shell Exploit]

'/home/usatwnzi/public_html/wp-content/plugins/paulworkspace/sy2019.php'
# Known exploit = [Fingerprint Match] [Hacker Sig Exploit [P1630]]

'/home/usatwnzi/public_html/wp-content/uploads/js_composer'
# World writeable directory

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/CdnEngine_Ftp.php'
# Regular expression match = [\n(?!\s*(//|\#|\*)).*\.ssh/]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/AmplifyBackend/AmplifyBackendClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/AmplifyBackend/Exception/AmplifyBackendException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ApiGatewayManagementApi/ApiGatewayManagementApiClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ApiGatewayManagementApi/Exception/ApiGatewayManagementApiException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ApiGatewayV2/ApiGatewayV2Client.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ApiGatewayV2/Exception/ApiGatewayV2Exception.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/CodeArtifact/CodeArtifactClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/CodeArtifact/Exception/CodeArtifactException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/NimbleStudio/NimbleStudioClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/NimbleStudio/Exception/NimbleStudioException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ServerlessApplicationRepository/ServerlessApplicationRepositoryClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ServerlessApplicationRepository/Exception/ServerlessApplicationRepositoryException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/kendra/kendraClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/kendra/Exception/kendraException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/theamericanmail.com/wp-content/uploads/js_composer'
# World writeable directory

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/CdnEngine_Ftp.php'
# Regular expression match = [\n(?!\s*(//|\#|\*)).*\.ssh/]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/AmplifyBackend/AmplifyBackendClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/AmplifyBackend/Exception/AmplifyBackendException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ApiGatewayManagementApi/ApiGatewayManagementApiClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ApiGatewayManagementApi/Exception/ApiGatewayManagementApiException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ApiGatewayV2/ApiGatewayV2Client.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ApiGatewayV2/Exception/ApiGatewayV2Exception.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/CodeArtifact/CodeArtifactClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/CodeArtifact/Exception/CodeArtifactException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/NimbleStudio/NimbleStudioClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/NimbleStudio/Exception/NimbleStudioException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ServerlessApplicationRepository/ServerlessApplicationRepositoryClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/ServerlessApplicationRepository/Exception/ServerlessApplicationRepositoryException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/kendra/kendraClient.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/w3-total-cache/vendor/aws/aws-sdk-php/src/kendra/Exception/kendraException.php'
# Regular expression match = [\*[A-Za-z0-9]{12,130}\*]

'/home/usatwnzi/thenewshunt.net/wp-content/plugins/woocommerce/vendor/maxmind-db/reader/ext/maxminddb.c'
# Suspicious file type [application/x-c]

'/home/usatwnzi/thenewshunt.net/wp-content/uploads/js_composer'
# World writeable directory

'/home/usatwnzi/tmp/awstats/ssl/awstats052022.bbctribune.com.txt'
# ClamAV detected virus = [{HEX}php.malware.magento.599.UNOFFICIAL]

----------- SCAN SUMMARY -----------
Scanned directories: 7884
Scanned files: 44291
Ignored items: 139
Suspicious matches: 53
Viruses found: 1
Fingerprint matches: 5
Data scanned: 1558.97 MB
Scan peak memory: 316776 kB
Scan time/item: 0.019 sec
Scan time: 1009.676 sec

0xn0l - 0011000001111000011011100011000001101100