----------- SCAN REPORT -----------
TimeStamp: Thu, 12 Jun 2025 09:42:35 -0400
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 50000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/predezso/scanreport-predezso-Jun_12_2025_09h42m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user predezso --virusscan --vmrssmax 2000000 --waitscan 0 --xtra /etc/cxs/cxs.xtra.manual)


Scanning /home/predezso:

'/home/predezso/.nc_plugin/hidden'
# World writeable directory

'/home/predezso/alwaysgaia.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/alwaysgaia.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/alwaysgaia.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-masterbar/src/admin-menu/class-admin-menu.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/amatearztokoemas.online/wp-content/plugins/all-in-one-seo-pack/app/Common/Views/admin/settings-page.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/amatearztokoemas.online/wp-content/plugins/woocommerce/includes/admin/class-wc-admin-menus.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/amatearztokoemas.online/wp-content/plugins/woocommerce/src/Internal/Admin/Settings/PaymentsController.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/amatearztokoemas.online/wp-content/plugins/woocommerce/vendor/maxmind-db/reader/ext/maxminddb.c'
# Suspicious file type [application/x-c]

'/home/predezso/buktijpgempatoto.com/index.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/buktijpgempatoto.com/.tmb'
# World writeable directory

'/home/predezso/buktijpgempatoto.com/wp-content/plugins/all-in-one-seo-pack/app/Common/Views/admin/settings-page.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/buktijpgempatoto.com/wp-content/plugins/file-manager-advanced/application/library/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/buktijpgempatoto.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/buktimedusatoto.com/godsend.php'
# Universal decode regex match = [universal decoder]
# (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP RFI Exploit [P2153]]

'/home/predezso/buktimedusatoto.com/hiroshi.php'
# (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match (fp)] [PHP RFI Exploit [P2153]]

'/home/predezso/buktimedusatoto.com/.tmb'
# World writeable directory

'/home/predezso/buktimedusatoto.com/wp-content/plugins/all-in-one-seo-pack/app/Common/Views/admin/settings-page.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/buktimedusatoto.com/wp-content/plugins/file-manager-advanced/application/library/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/buktimedusatoto.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/cheatslotpro.com/index.php'
# Known exploit = [Fingerprint Match (fp)] [PHP OBF Exploit [P2247]]

'/home/predezso/cheatslotpro.com/.tmb'
# World writeable directory

'/home/predezso/cheatslotpro.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/elegantprints.it.com/.tmb'
# World writeable directory

'/home/predezso/elegantprints.it.com/wp-content/plugins/duplicator/classes/class.constants.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/elegantprints.it.com/wp-content/plugins/file-manager-advanced/application/library/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/elegantprints.it.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/prediksijitumacau.com/index.php'
# Decode regex match = [decode regex: 1]

'/home/predezso/prediksijitumacau.com/item.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/networks.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/plugins.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/wp-admin/options.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/wp-admin/wp-log1n.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/wp-content/plugins/all-in-one-seo-pack/app/Common/Views/admin/settings-page.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/prediksijitumacau.com/wp-content/plugins/litespeed-cache/src/cdn/embeds/index.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/prediksijitumacau.com/wp-content/themes/twentytwentyfive/assets/css/embeds/index.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/wp-includes/click.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/wp-includes/Requests/src/Exception/Http/search-api/index.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/prediksijitumacau.com/wp-includes/sodium_compat/src/Core/Poly1305/query-content/index.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/samashtimedia.com/wp-content/plugins/all-in-one-seo-pack/app/Common/Views/admin/settings-page.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/samashtimedia.com/wp-content/plugins/file-manager-advanced/application/library/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/samashtimedia.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-masterbar/src/admin-menu/class-admin-menu.php'
# Universal decode regex match = [universal decoder]

'/home/predezso/samashtimedia.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/westpalmbeachinsulation.com/index.php'
# Decode regex match = [decode regex: 1]

'/home/predezso/westpalmbeachinsulation.com/item.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/westpalmbeachinsulation.com/plugins.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/westpalmbeachinsulation.com/wp-admin/click.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/westpalmbeachinsulation.com/wp-admin/item.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/westpalmbeachinsulation.com/wp-content/product.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/westpalmbeachinsulation.com/wp-content/plugins/loginizer/lib/IPv6/post-catalog/index.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/westpalmbeachinsulation.com/wp-content/plugins/pagelayer/js/blocks/upgrades/index.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

'/home/predezso/westpalmbeachinsulation.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/predezso/westpalmbeachinsulation.com/wp-content/themes/twentytwentyfour/assets/css/audits/index.php'
# ClamAV detected virus = [TO-38697.WEBSHEL.nc__php.MD5-90b535d1e1c05c432fff4af9e35b3b4b.size-102.UNOFFICIAL]

----------- SCAN SUMMARY -----------
Scanned directories: 21473
Scanned files: 133970
Ignored items: 379
Suspicious matches: 54
Viruses found: 18
Fingerprint matches: 3
Data scanned: 4045.49 MB
Scan peak memory: 423828 kB
Scan time/item: 0.069 sec
Scan time: 10655.585 sec