0

I am assigned to do daily malware scans on our Wordpress website to make sure everything is going right. Therefor I have installed Maldetect 1.5 and ClamAV. As I wanted to know if everything is working as it should be, I uploaded an example malware file with with base64 hidden PHP code as copied from https://aw-snap.info/articles/php-examples.php.

However, if I scan these files, Maldetect say "files 4, malware hits 0, cleaned hits 0".

This means that I cannot be sure that Maldetect is actually detecting existing malware. Does anyone here have experience with this and wants to help me?

Cheers

1

Hacker is encrypting those hack tools/shell scripts in order for it to be FUD (Fully Undetected or Fully Undetectable). The best you can do is to submit those files to ClamAV and Maldetect so they can add it to their database and successfully detect them next time.

EDIT

Instead of you doing those scans every day I highly recommend you to run cron for ClamAV

crontab -e #Open cron file

0 4 * * * /usr/local/cpanel/3rdparty/bin/clamscan -ri --remove /home 2>&1 | mail -s "ClamAV Scan Log" your@email.com

This will run a scan every day at 4 AM, DELETE infected files and email log to you. Change /home to your websites path or scan everything /
Also I recommend you to enable monitoring for Maldetect

1

Posting "malware" examples can be problematic because the A/V vendors tend to flag your site. One method to get around that is to post the code as an image, another way is to "break" the code by adding zero-length spaces ​ at key locations. If you look at the source code for that page the examples are going to be

ev​al(base​64_de​code("ZXJyb3JfcmVwb3J0aW5nKDAp.....

If you wanted to test with any of those examples you would have to clean them up.

No idea why the A/V vendors flag those examples since they are not gone to execute in a browser but that is another story.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.