Extending ClamAV Signatures with RFXN Database for PHP Malware’s

extending clamav signatures

You can use 3rd party compiled malware and virus signature databases to extend ClamAV signature database collection with better detection PHP malwares. RFXN (R-FX NETWORKS) Database signature are updated typically once per day or more frequently depending on incoming threat data from the LMD checkout feature, IPS malware extraction and other sources. Installation Add the … Read more

Buy Signature subscribers

Malware Signatures

ClamAV is an open-source anti-virus engine designed to detect viruses, Trojans, malware and other threats. It supports multiple file formats (documents, executables or archives), uses multi-threaded scanner features and receives updates 3-4 times a day for its signature database. Additionally, we are updating our database, so the user will get improved results. Benefits of using … Read more

Howto detect malware’s with WP-CLI

WP-CLI is the command-line interface for WordPress. You can update plugins, configure multisite installations and much more, without using a web browser. This tool need ssh access to server using it. More information for this tool found their homepage. This tutorial we show how you can detect malware’s in WordPress installation. WP-CLI Installation Depend your … Read more

Malware plugin’s to WordPress (woocomerce & aksimet)

Malware Signature Updates

When WordPress website user account compromised, there is possibility upload plugins. We have seen new malware plugins for WordPress which are named with woocomerce and aksimet. These plugins not have anything doing with real plugins, which are woocommerce and akismet. Both of these plugins use WordPress add_action(‘init’,”) function to activate itself and ready take commands … Read more

Malware Scanner Tools for Linux

malware scanner tools

We all know that Linux is the most powerful operating system around us, but there is a misconception that Linux does not need any antivirus programs on it. For maximum protection this is essential. More than 60% of web-servers are running on Linux servers and most of them are protected with some solutions. From my … Read more

Decode signatures with Sigtool

Tutorial

When you are scanning malware example ClamAV or Maldet from files in server and get positive hit, you may difficult find where has injected code in the file. For decoding signature you can use ClamAV sigtool command line tool. This will help you find the right position from infected file and remove malware code. Positive … Read more

styles.php malware

Malware details

Again, we found interesting malware (styles.php), which try to add more backdoor files to the web server. This file is just copied from the original file: load-styles.php. If you look fast this file, it’s look normal PHP file, but there is a modification of the begin (comments not finished line 6): It self hidden malware … Read more

Pure-FTPd with ClamAV at Directadmin Custombuild

Tutorial

This tutorial we integrate ClamAV into Pure-FTPd for virus scanning in Directadmin server with Custombuild. Whenever a file gets uploaded through Pure-FTPd, ClamAV will check the file and delete it if it is malware. Installing Pure-FTPd & ClamAV First we need change custom build options.conf setting Check options.conf #ClamAV-related Settings clamav=yes pureftpd_uploadscan=yes Building software Building … Read more

WordPress Hidden Include

Malware details

Today we found undetected malware, which keep it hidden and try loading again if it deleted. We generated Signatures to Detect these hidden includes: /index.php: {HEX}Malware.Expert.wordpress.hidden.include.0.UNOFFICIAL FOUND /wp-load.php: {HEX}Malware.Expert.wordpress.hidden.include.1.UNOFFICIAL FOUND /wp-includes/template.php: {HEX}Malware.Expert.malware.url.7od.info.0.UNOFFICIAL FOUND /wp-includes/Requests/IPconfig.ini: {HEX}Malware.Expert.generic.malware.39.UNOFFICIAL FOUND /wp-includes/js/utilities.js: {HEX}Malware.Expert.generic.malware.39.UNOFFICIAL FOUND WordPress index.php wp-load.php End of file: template.php IPconfig.ini Remove file utilities.js Remove file Final Words Use … Read more