Clook Hosting: False Positives from Securi?

[LeMarchand]

Does anyone else use Clook for hosting?

 

We've been getting warnings about our site being infected from time to time and are trying to work out if there is a reason to be concerned, or if they're false positives.

Edited May 21, 2018 by LeMarchand

[Marci]

All depends where the warnings are coming from... and what they say!

[LeMarchand]

All depends where the warnings are coming from... and what they say!

 

Have edited title! The warnings are from Securi, who are picking up random files that are allegedly malware (but we can't find).

[Marci]

I take it we're talking Wordpress here then seeing as Sucuri's involved...? Can you copy and paste or screenshot the specific audit log entry from the Sucuri dashboard in wp-admin? Sucuri's rarely wrong (ime)...

[LeMarchand]

I take it we're talking Wordpress here then seeing as Sucuri's involved...? Can you copy and paste or screenshot the specific audit log entry from the Sucuri dashboard in wp-admin? Sucuri's rarely wrong (ime)...

 

Yep. Will have to email the head to see if he still has details - I'm not back there until June 4th.

[LeMarchand]

Here we go for the last lot:

 

{HEX}Malware.Expert.php.cmdshell.generic.3 : /home/REDACTED/public_html/blogs.dir/confi_g.php
{HEX}Malware.Expert.php.cmdshell.generic.3 : /home/REDACTED/public_html/blogs.dir/wpc_log.php
{HEX}Malware.Expert.php.cmdshell.generic.3 : /home/REDACTED/public_html/wp-content/confi_g.php
{HEX}Malware.Expert.php.cmdshell.generic.3 : /home/REDACTED/public_html/wp-content/wpc_log.php
{HEX}Malware.Expert.php.cmdshell.generic.3 : /home/REDACTED/public_html/wp-content/uploads/2015/07/license.php
{HEX}Malware.Expert.php.cmdshell.generic.3 : /home/REDACTED/public_html/wp-docs/confi_g.php
{HEX}Malware.Expert.php.cmdshell.generic.3 : /home/REDACTED/public_html/wp-docs/wpc_log.php

[Marci]

Righty - you're saying you can't find those files - how are you looking for them? Are you trying to hit them in a web-browser, or are you SSH / ftp-ing into the server and checking for them?

 

They've existed at some point for Sucuri to pick them up in a scan, so whether you can find them or not, yes - your site is compromised - these are not false positives (and it'll have very little to do with the hosting provider, Clook)

Is it only a Wordpress install on there, or are there other things besides in the same hosting?

What plugins are installed on the site?

Are they all up-to-date from the WP Plugin Database?

 

Are all your wp themes up to date also?

Is the site running latest version of Wordpress (4.9.6 at time of writing)?

Edited May 22, 2018 by Marci

[LeMarchand]

Was looking via CPanel

 

Unfortunately I'll have to quiz the head on the other stuff, as it's his baby. AFAIK it's just WP + a few plugins, some of which did need updating (but it's been done now).

 

Thanks for your help on this, but I think I'm going to have to be on site with the head (who has all the credentials) to hand. I'm hoping it will be OK to hit you up for more help after 1/2 term.

 

Thanks for all the input so far.