File Manager

----------- SCAN REPORT ----------- TimeStamp: Tue, 3 Jun 2025 17:40:41 -0400 (/usr/sbin/cxs --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 50000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/casageo/scanreport-casageo-2025-06-03T21:40:40.680144.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user casageo --virusscan --vmrssmax 2000000 --waitscan 0 --xtra /etc/cxs/cxs.xtra.manual) Scanning /home/casageo: '/home/casageo/.nc_plugin/hidden' # World writeable directory '/home/casageo/fidelaadvisors.com/annmanagement.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/details.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/backup-backup/includes/dashboard/com_letterman.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-forms/src/contact-form/templates/NameSync.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-forms/src/contact-form/templates/xml_domit_parser.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-forms/src/dashboard/advcache.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-forms/src/dashboard/rvscronjobctrl.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-masterbar/src/admin-menu/class-admin-menu.php' # Universal decode regex match = [universal decoder] '/home/casageo/fidelaadvisors.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-waf/src/exceptions/chmod.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-waf/src/exceptions/document_product.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/db_details.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/wp_shopping_cart_reference.php' # ClamAV detected virus = [TO-38697.WEBSHEL.nc_exots_php.MD5-aa76e782c2d1837bec27f82c7dba4ad0.size-718.UNOFFICIAL] '/home/casageo/fidelaadvisors.com/wp-content/plugins/wordpress-simple-paypal-shopping-cart/lib/stripe-gateway/lib/Service/Apps/product_listing3.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/plugins/wordpress-simple-paypal-shopping-cart/lib/stripe-gateway/lib/Service/Terminal/typography.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/fidelaadvisors.com/wp-content/themes/astra/admin/includes/class-astra-menu.php' # Universal decode regex match = [universal decoder] '/home/casageo/fidelacommodities.com/wp-content/ewww/gifsicle' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/ewww/jpegtran' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/ewww/optipng' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/ewww/pngquant' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/blocksy-companion/framework/dashboard.php' # Universal decode regex match = [universal decoder] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/cwebp-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/cwebp-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/cwebp.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/optipng-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/optipng-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/optipng.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/pngquant-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/pngquant-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/fidelacommodities.com/wp-content/plugins/ewww-image-optimizer/binaries/pngquant.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/fidelacommodities.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-masterbar/src/admin-menu/class-admin-menu.php' # Universal decode regex match = [universal decoder] '/home/casageo/fidelacommodities.com/wp-content/plugins/woocommerce/includes/admin/class-wc-admin-menus.php' # Universal decode regex match = [universal decoder] '/home/casageo/fidelacommodities.com/wp-content/plugins/woocommerce/src/Internal/Admin/WcPayWelcomePage.php' # Universal decode regex match = [universal decoder] '/home/casageo/fidelacommodities.com/wp-content/plugins/woocommerce/src/Internal/Admin/Settings/PaymentsController.php' # Universal decode regex match = [universal decoder] '/home/casageo/fidelacommodities.com/wp-content/plugins/woocommerce/vendor/maxmind-db/reader/ext/maxminddb.c' # Suspicious file type [application/x-c] '/home/casageo/fidelacommodities.com/wp-content/themes/blocksy/admin/dashboard/core.php' # Universal decode regex match = [universal decoder] '/home/casageo/fidelacommodities.com/wp-includes/block-patterns/config-main.php' # Decode regex match = [decode regex: 1] '/home/casageo/public_html/PMA_List.class.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/Request.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/cma_classified.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/delete_message.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/helvetica.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/java.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/lscript.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/update_function.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/xml_domit_parser.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/dup-installer/src/Models/trackback5' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/dup-installer/templates/default/pages-parts/body/updatecats' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/dup-installer/templates/default/parts/params/customer_lookup' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/dup-installer/templates/import-advanced/pages-parts/step1/actions/form_execute' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-admin/network/config-main.php' # Decode regex match = [decode regex: 1] '/home/casageo/public_html/wp-content/ewww/gifsicle' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/ewww/jpegtran' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/ewww/optipng' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/ewww/pngquant' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/blocksy-companion/framework/dashboard.php' # Universal decode regex match = [universal decoder] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/cwebp-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/cwebp-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/cwebp.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/optipng-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/optipng-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/optipng.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/pngquant-fbsd' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/pngquant-linux' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/ewww-image-optimizer/binaries/pngquant.exe' # MS Windows Binary/Executable [application/x-winexec] '/home/casageo/public_html/wp-content/plugins/maintenance/includes/action.upload' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/wp-mail-smtp/src/Admin/Area.php' # Universal decode regex match = [universal decoder] '/home/casageo/public_html/wp-content/plugins/wp-mail-smtp/src/Admin/SetupWizard.php' # Universal decode regex match = [universal decoder] '/home/casageo/public_html/wp-content/plugins/wp-mail-smtp/vendor/woocommerce/action-scheduler/classes/migration/login_old.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/wp-content/plugins/wp-mail-smtp/vendor_prefixed/google/apiclient/src/AccessToken/agendaplace3' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/wp-mail-smtp/vendor_prefixed/google/auth/src/HttpHandler/usergroup_18.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/wp-content/plugins/wp-mail-smtp/vendor_prefixed/guzzlehttp/guzzle/src/Exception/homepage_buttons.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/wp-content/plugins/wp-mail-smtp/vendor_prefixed/guzzlehttp/psr7/src/Exception/recette_topics' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/wp-mail-smtp/vendor_prefixed/psr/log/Psr/XHTMLStrict' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/wpforms-lite/lite/templates/admin/entries/overview/thankform.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/wp-content/plugins/wpforms-lite/vendor/symfony/polyfill-iconv/jpgraph_pie' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/plugins/wpforms-lite/vendor_prefixed/stripe/stripe-php/lib/Service/TestHelpers/Issuing/parentlinks' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-content/themes/blocksy/admin/dashboard/core.php' # Universal decode regex match = [universal decoder] '/home/casageo/public_html/wp-content/uploads/2022/04/vcard.class' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-includes/block-supports/Discover.php' # Regular expression match = [eval\s*\(\s*urldecode\s*\(] '/home/casageo/public_html/wp-includes/blocks/image/album_rate' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-includes/blocks/term-description/whos_online' # Linux Binary/Executable [application/x-executable] '/home/casageo/public_html/wp-includes/css/dist/block-library/elementrenderer' # Linux Binary/Executable [application/x-executable] ----------- SCAN SUMMARY ----------- Scanned directories: 14618 Scanned files: 74955 Ignored items: 689 Suspicious matches: 95 Viruses found: 1 Fingerprint matches: 0 Data scanned: 9797.10 MB Scan peak memory: 406820 kB Scan time/item: 0.026 sec Scan time: 2347.995 sec