----------- SCAN REPORT -----------
TimeStamp: Fri, 5 Dec 2025 19:31:44 -0500
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 50000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/gamerijr/scanreport-gamerijr-Dec_05_2025_19h31m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user gamerijr --virusscan --vmrssmax 2000000 --waitscan 0 --xtra /etc/cxs/cxs.xtra.manual)


Scanning /home/gamerijr:

'/home/gamerijr/.nc_plugin/hidden'
# World writeable directory

'/home/gamerijr/.trash/ALFA_DATA/alfacgiapi/alfacgiapi/alfacgiapi/alfacgiapi/alfacgiapi/alfacgiapi/bmp_6929bfe7ed25d.zip'
# (compressed file: b_6929bfe7ed25d.tmp [depth: 1]) Known exploit = [Fingerprint Match (fp)] [PHP Exploit [P2202]]

'/home/gamerijr/.trash/wp-includes/ID3/ID3/xpTFhQBbWLtgUv.png'
# Suspicious image file (hidden script file)

'/home/gamerijr/.trash/wp-includes/Text/Diff/Engine/qspqrrorr.ttf'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/.trash/wp-includes/blocks/cover/style-rel.css'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/.trash/wp-includes/blocks/footnotes/footnotes/m3u_69291ddea1fa5.zip'
# (compressed file: b_69291ddea1fa5.tmp [depth: 1]) Known exploit = [Fingerprint Match (fp)] [PHP Exploit [P2202]]

'/home/gamerijr/.trash/wp-includes/css/dist/list-reusable-blocks/list-reusable-blocks/uFKiHtyvYXhjpRcIG.jpg'
# Suspicious image file (hidden script file)

'/home/gamerijr/.trash/wp-includes/images/w-dfcdeebee.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/gamerijr/.trash/wp-includes/images/wpspin-1x.gif'
# Suspicious image file (hidden script file)

'/home/gamerijr/.trash/wp-includes/images/xit-3x.gif'
# Suspicious image file (hidden script file)

'/home/gamerijr/.trash/wp-includes/images/media/dfcdeebee.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/gamerijr/.trash/wp-includes/js/codemirror/codemirror/VGHTarc.tiff'
# Suspicious image file (hidden script file)

'/home/gamerijr/belal.gameshop4u.com/m3.jpg'
# Suspicious image file (hidden script file)

'/home/gamerijr/belal.gameshop4u.com/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.6.4 < v6.8.2]

'/home/gamerijr/cialisip.com/static/vendor/fontawesome/sprites/248630/index.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/elfla7.com/.well-known/pki-validation/85343/496085/index.php'
# ClamAV detected virus = [TO-40090.WEBSHEL./root/TO-40090/files/premium251.web-hosting.com_reminivs_doc.php.MD5-76eeaecded639a6d8212516ff1d6e6ea.size-201163.UNOFFICIAL]

'/home/gamerijr/gameshop4u.com/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/gameshop4u.com/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/gameshop4u.com/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/gameshop4u.com/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/gameshop4u.com/wp-content/plugins/hurrytimer/includes/Admin.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/gameshop4u.com/wp-content/plugins/quick-adsense-reloaded/includes/admin/admin-pages.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/gameshop4u.com/wp-content/plugins/wp-live-chat-support/admin/class-wplc-plugin-settings.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/gameshop4u.com/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.6.4 < v6.8.2]

'/home/gamerijr/ghandour.site/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/ghandour.site/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/ghandour.site/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/ghandour.site/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/ghandour.site/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/ghandour.site/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/ghandour.site/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.7.4 < v6.8.2]

'/home/gamerijr/helaly.site/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/helaly.site/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/helaly.site/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/helaly.site/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/jackorswell.com/images/images/wCmsRAXQMaqiGvJTgN.gif'
# Suspicious image file (hidden script file)

'/home/gamerijr/jackorswell.com/images/images/images/images/images/qArWBfEnKLGMwtgkUup.tiff'
# Suspicious image file (hidden script file)

'/home/gamerijr/jackorswell.com/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/jackorswell.com/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/jackorswell.com/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/jackorswell.com/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/jackorswell.com/wp-content/plugins/akismet/_inc/img/logo-qspqrrorr.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/gamerijr/jackorswell.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/jackorswell.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/jackorswell.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/gamerijr/jackorswell.com/wp-content/plugins/wp-recipe-maker/includes/admin/menu/class-wprm-admin-menu.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/kora.gameshop4u.com/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/kora.gameshop4u.com/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/kora.gameshop4u.com/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/kora.gameshop4u.com/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/gamerijr/kora.gameshop4u.com/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.6.4 < v6.8.2]

'/home/gamerijr/lapp/vendor/symfony/console/Resources/bin/hiddeninput.exe'
# MS Windows Binary/Executable [application/x-winexec]