0UT1S's

----------- SCAN REPORT -----------
TimeStamp: Fri, 14 Mar 2025 03:31:52 -0400
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 50000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/aioutajg/scanreport-aioutajg-Mar_14_2025_03h31m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user aioutajg --virusscan --vmrssmax 2000000 --waitscan 0 --xtra /etc/cxs/cxs.xtra.manual)

Scanning /home/aioutajg:

'/home/aioutajg/.cpanel/live-engine-connector-rvlYWM24S0.sock'
# Socket

'/home/aioutajg/.nc_plugin/hidden'
# World writeable directory

'/home/aioutajg/8171bispupdate.com/uploads/1452237617_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/8171bispupdate.com/uploads/621463340_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/8171bispupdate.com/uploads/960871/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-admin/maint/557353/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-admin/network/732398/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-admin/user/582409/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-content/backuply/backups-zoZ4U1/tmp/753151/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-content/backuply/backups_info-zoZ4U1/62831/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-content/boost-cache/.boost-cache.php'
# ClamAV detected virus = [TO-34875.WEBSHEL.blocks_php.MD5-a960c6bf8b5a923577a56a04de9e8c30.size-3699.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-content/cache/.cache.php'
# ClamAV detected virus = [TO-34875.WEBSHEL.blocks_php.MD5-a960c6bf8b5a923577a56a04de9e8c30.size-3699.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-content/cache/soledad_pagespeed/css/656756/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-content/cache/used-css/1/2/f/773225/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-content/jetpack-waf/rules/33657/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-content/plugins/content-views-query-and-display-post-page/admin/views/dashboard.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/8171bispupdate.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/8171bispupdate.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/8171bispupdate.com/wp-content/plugins/wp-seopress/inc/admin/admin.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/8171bispupdate.com/wp-content/plugins/wp-seopress/inc/admin/admin-bar/admin-bar.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/8171bispupdate.com/wp-content/plugins/wp-seopress/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/8171bispupdate.com/wp-content/plugins/wp-seopress/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/8171bispupdate.com/wp-content/themes/soledad/inc/dashboard/lib/meta-box/inc/about/about.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/8171bispupdate.com/wp-content/w3tc-config/510856/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-includes/Requests/library/40580/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-includes/certificates/594619/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-includes/theme-compat/846157/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]

'/home/aioutajg/8171bispupdate.com/wp-includes/widgets/175390/index.php'
# ClamAV detected virus = [TO-37313.WEBSHEL.nc_1_index_notags_php.MD5-15215b4a34dba56b797763bcfe1417c8.size-13946.UNOFFICIAL]
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/freecrazygames.xyz/13-10-24.zip'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/freecrazygames.xyz/Zontal-v1.5.zip'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/freecrazygames.xyz/old bu.zip'

'/home/aioutajg/freecrazygames.xyz/static/img/logo/462546570test.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/freecrazygames.xyz/static/img/logo/uploads/1470105775_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/freecrazygames.xyz/static/img/logo/uploads/o.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/freecrazygames.xyz/uploads/3835831282_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/freecrazygames.xyz/uploads/986337159_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/gepcobillonline.xyz/backup.zip'

'/home/aioutajg/gepcobillonline.xyz/p/2index.php'
# Universal decode regex match = [universal decoder]
# (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP Shell Exploit [P1295]]

'/home/aioutajg/gepcobillonline.xyz/uploads/3695905129_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/nerdemoji.xyz/Backup.zip'

'/home/aioutajg/nerdemoji.xyz/assets/images/index.php'
# Universal decode regex match = [universal decoder]
# (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP Shell Exploit [P1295]]

'/home/aioutajg/pdfbirle.com/uploads/926227569_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/playpauseonline.com/static/img/logo/uploads/3719106087_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/playpauseonline.com/uploads/1622423645_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/playpauseonline.com/uploads/918260903_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/public_html/includes.zip'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/softaculous_backups/wp.26_67837.2025-03-01_02-59-41.tar.gz'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/softaculous_backups/wp.26_67837.2025-03-13_02-29-21.tar.gz'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/softaculous_backups/wp.26_70903.2025-02-20_02-35-42.tar.gz'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/softaculous_backups/wp.26_70903.2025-02-26_02-30-36.tar.gz'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/test.aioubooks.online/cloudarcade.zip'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/test.poststime.com/composer_home.zip'
# Scan Timeout (30 secs) while processing:
'/home/aioutajg/test.poststime.com/composer_home/cache/files/google/apiclient-services/f50cfce38f1e4a98bb6e21d2a4ffc16d0eaa4db4.zip'

'/home/aioutajg/test.poststime.com/uploads/615326235_index.php'
# Regular expression match = [eval\s*\(\s*urldecode\s*\(]
# Decode regex match = [decode regex: 1]

'/home/aioutajg/test.poststime.com/vendor/google/apiclient-services/src/TagManager/2index.php'
# Universal decode regex match = [universal decoder]
# (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP Shell Exploit [P1295]]

'/home/aioutajg/test.poststime.com/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/test.poststime.com/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/unblockedgames247.com/wp-content/plugins/fast-indexing-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/unblockedgames247.com/wp-content/plugins/fast-indexing-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/aioutajg/watermarkimage.online/tinyobfus.php'
# ClamAV detected virus = [{HEX}php.base64.inject.182.UNOFFICIAL]

----------- SCAN SUMMARY -----------
Scanned directories: 5992
Scanned files: 72001
Ignored items: 294
Suspicious matches: 67
Viruses found: 17
Fingerprint matches: 3
Data scanned: 2773.65 MB
Scan peak memory: 424300 kB
Scan time/item: 0.092 sec
Scan time: 7154.223 sec

By Order of Mr.0UT1S