✘✘ GRAYBYTE WORDPRESS FILE MANAGER ✘✘

🇳🇦🇲🇪♯➤ server366.web-hosting.com 🇻♯➤ 4.18.0-553.50.1.lve.el8.x86_64 #1 SMP 🇾♯➤ 2025

𝗛𝗢𝗠𝗘 𝗜𝗗 ♯➤ 67.223.118.204 ♯➤ 𝗔𝗗𝗠𝗜𝗡 𝗜𝗗 216.73.217.103
𝗢𝗣𝗧𝗜𝗢𝗡𝗦 ♯ CRL ♯➤ 𝗢𝗞 ┃ WGT ♯➤ 𝗢𝗞 ┃ SDO ♯➤ 𝗢𝗙𝗙 ┃ PKEX ♯➤ 𝗢𝗙𝗙
𝗗𝗘𝗔𝗖𝗧𝗜𝗩𝗔𝗧𝗘𝗗 ♯➤ 𝗔𝗟𝗟 𝗪𝗢𝗥𝗞𝗜𝗡𝗚....

𝗖𝗨𝗥𝗥𝗘𝗡𝗧 𝗙𝗜𝗟𝗘 : /home/builxejc//scanreport-builxejc-Dec_12_2025_02h34m.txt

----------- SCAN REPORT -----------
TimeStamp: Fri, 12 Dec 2025 02:34:50 -0500
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 50000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/builxejc/scanreport-builxejc-Dec_12_2025_02h34m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user builxejc --virusscan --vmrssmax 2000000 --waitscan 0 --xtra /etc/cxs/cxs.xtra.manual)


Scanning /home/builxejc:

'/home/builxejc/.caldav/accounts@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/arthurkaramagi@bonnextrading.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/bar@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/birungirobinah@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/bonnymunihizi@bonnextrading.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/builxejc/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/byamukamadavid@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/cafedelit@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/frontoffice@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/generalmanager@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/hildakobugabe@bonnextrading.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/josephbwango@bonnextrading.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/kangumemilly@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/karungiharriet@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/moristembo@bonnextrading.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/muligirwamariam@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/munihizibonny@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/nuwagabamollen@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/tumusiimehenry@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.caldav/wycliffalinaitwe@ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.cl.selector/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.cpanel/caches/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.cpanel/datastore/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.cpanel/ea-php-cli/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.cpanel/icals/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.cpanel/nvdata/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.cpanel/vcards/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.cpanel/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.htpasswds/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.koality/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.nc_plugin/hidden'
# World writeable directory

'/home/builxejc/.softaculous/backups/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.softaculous/logs/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.softaculous/sess/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.softaculous/status/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.softaculous/tmp/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.softaculous/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.softaculous/wp_manager/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.spamassassin/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.subaccounts/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.trash/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/.well-known/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/bonnextrading.com/caleb-wip/admin.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/bonnextrading.com/caleb-wip/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/bonnextrading.com/caleb-wip/profile.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/bonnextrading.com/caleb-wip/mu-plugins/assets/assets/assets/EjbkRSVMZWvl.gif'
# Suspicious image file (hidden script file)

'/home/builxejc/bonnextrading.com/wp-content/plugins/elementskit/libs/composer/vendor/build/vendor/src/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/builxejc/bonnextrading.com/wp-content/plugins/elementskit/libs/composer/vendor/build/vendor/src/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/builxejc/bonnextrading.com/wp-content/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/etc/bonnextrading.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/etc/ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/etc/postfix/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/etc/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/logs/roundcube/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/logs/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/0/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/1/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/2/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/3/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/4/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/5/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/6/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/7/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/8/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/9/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/a/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/b/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/c/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/d/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/e/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/f/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/priv/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/lscache/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/.Drafts/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/.Junk/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/.Sent/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/.Trash/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/cur/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/extra-wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/accounts/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/bar/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/birungirobinah/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/byamukamadavid/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/cafedelit/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/frontoffice/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/generalmanager/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/kangumemilly/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/karungiharriet/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/muligirwamariam/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/munihizibonny/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/nuwagabamollen/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/tumusiimehenry/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/ngabuhotel.com/wycliffalinaitwe/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/tmp/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/mail/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/public_ftp/incoming/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/public_ftp/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/public_html/edgar-obsolete/admin.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/public_html/edgar-obsolete/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/public_html/edgar-obsolete/profile.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/public_html/edgar-obsolete/edgar-obsolete/cNBmSfzLtHwxlUbnArR.jpg'
# Suspicious image file (hidden script file)

'/home/builxejc/public_html/edgar-obsolete/edgar-obsolete/edgar-obsolete/GlPTiIw.png'
# Suspicious image file (hidden script file)

'/home/builxejc/public_html/wp-admin/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/public_html/wp-content/plugins/akismet/_inc/img/logo-pqosrroonrnrsqrro.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-content/plugins/woocommerce/includes/admin/class-wc-admin-menus.php'
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-content/plugins/woocommerce/src/Internal/Admin/Settings/PaymentsController.php'
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-content/plugins/woocommerce/vendor/maxmind-db/reader/ext/maxminddb.c'
# Suspicious file type [application/x-c]

'/home/builxejc/public_html/wp-content/plugins/wordpress-popup/inc/class-hustle-dashboard-admin.php'
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-content/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/public_html/wp-includes/Text/Diff/Engine/pqosrroonrnrsqrro.ttf'
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-includes/blocks/cover/style-rel.css'
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-includes/images/w-cdbfeebbaeaefdeeb.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-includes/images/wpspin-1x.gif'
# Suspicious image file (hidden script file)

'/home/builxejc/public_html/wp-includes/images/xit-3x.gif'
# Suspicious image file (hidden script file)

'/home/builxejc/public_html/wp-includes/images/media/cdbfeebbaeaefdeeb.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/builxejc/public_html/wp-includes/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/softaculous_backups/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/ssl/certs/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/ssl/csrs/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/ssl/keys/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/ssl/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/tmp/analog/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/tmp/awstats/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/tmp/locks/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/tmp/pma_template_compiles_builxejc/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/tmp/webalizer/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/tmp/webalizerftp/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/tmp/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

'/home/builxejc/wp-back/index.php'
# (decoded file [depth: 0]) ClamAV detected virus = [YARA.PHP_backdoor_index_and_CURL.UNOFFICIAL]

----------- SCAN SUMMARY -----------
Scanned directories: 9109
Scanned files: 47786
Ignored items: 258
Suspicious matches: 136
Viruses found: 114
Fingerprint matches: 0
Data scanned: 1974.37 MB
Scan peak memory: 386808 kB
Scan time/item: 0.031 sec
Scan time: 1770.092 sec

[ Back ]

𝗡𝗔𝗠𝗘	𝗦𝗜𝗭𝗘	𝗟𝗔𝗦𝗧 𝗧𝗢𝗨𝗖𝗛	𝗨𝗦𝗘𝗥	𝗦𝗧𝗔𝗧𝗨𝗦
..	--	17 Jul 2025 4.24 PM	root / nobody	0755
.cagefs	--	20 Dec 2025 1.17 AM	builxejc / builxejc	0771
.caldav	--	5 Mar 2026 9.00 AM	builxejc / builxejc	0755
.cl.selector	--	3 Jun 2026 5.02 AM	builxejc / builxejc	0755
.cpanel	--	16 Jun 2026 2.03 PM	builxejc / builxejc	0700
.htpasswds	--	20 Dec 2025 1.17 AM	builxejc / nobody	0750
.koality	--	20 Dec 2025 1.17 AM	builxejc / builxejc	0755
.nc_plugin	--	17 Jul 2025 4.05 PM	root / root	0711
.softaculous	--	4 Feb 2026 8.29 PM	builxejc / builxejc	0711
.spamassassin	--	27 May 2026 2.06 PM	builxejc / builxejc	0700
.subaccounts	--	20 Dec 2025 1.17 AM	builxejc / builxejc	0700
.trash	--	16 Jun 2026 5.04 AM	builxejc / builxejc	0700
.well-known	--	20 Dec 2025 1.17 AM	builxejc / builxejc	0755
bonnextrading.com	--	16 Jun 2026 10.12 AM	builxejc / nobody	0750
bonnextrading.comkjhy	--	28 Apr 2026 9.10 AM	builxejc / nobody	0750
etc	--	2 Jun 2026 10.41 AM	builxejc / mail	0750
logs	--	14 Jun 2026 12.07 PM	builxejc / builxejc	0700
lscache	--	20 Dec 2025 1.17 AM	nobody / builxejc	2770
mail	--	16 Jun 2026 8.13 AM	builxejc / builxejc	0751
public_ftp	--	20 Dec 2025 1.17 AM	builxejc / builxejc	0750
public_html	--	16 Jun 2026 11.44 AM	builxejc / nobody	0777
softaculous_backups	--	11 Jun 2026 7.54 PM	builxejc / builxejc	0711
ssl	--	27 Apr 2026 5.05 AM	builxejc / builxejc	0755
tmp	--	16 Jun 2026 2.06 PM	builxejc / builxejc	0755
wp-back	--	20 Dec 2025 1.17 AM	builxejc / builxejc	0755
wpback	--	20 Dec 2025 1.17 AM	builxejc / builxejc	0755
www	--	16 Jun 2026 11.44 AM	builxejc / nobody	0777

.bash_logout	0.018 KB	17 Jul 2025 4.05 PM	builxejc / builxejc	0644
.bash_profile	0.138 KB	17 Jul 2025 4.05 PM	builxejc / builxejc	0644
.bashrc	0.367 KB	17 Jul 2025 4.05 PM	builxejc / builxejc	0644
.clamavconnector.status	0.194 KB	30 Dec 2025 11.37 AM	builxejc / builxejc	0644
.contactemail	0.02 KB	3 May 2026 9.07 PM	builxejc / builxejc	0644
.gemrc	0.136 KB	17 Jul 2025 4.05 PM	builxejc / builxejc	0644
.imunify_patch_id	0.104 KB	17 Jul 2025 7.00 PM	builxejc / builxejc	0660
.last.inodes	6.108 KB	16 Jun 2026 9.38 AM	root / root	0644
.lastlogin	0.568 KB	9 Jun 2026 8.30 AM	builxejc / builxejc	0600
.myimunify_id	0.1 KB	17 Jul 2025 7.00 PM	builxejc / builxejc	0660
.spamassassinboxenable	0 KB	17 Jul 2025 4.05 PM	builxejc / builxejc	0644
.spamassassinenable	0 KB	17 Jul 2025 4.05 PM	builxejc / builxejc	0644
mail.zip	38.73 MB	11 Dec 2025 6.59 AM	builxejc / builxejc	0644
scanreport-builxejc-2025-12-30T09:34:58.275391.txt	40.952 KB	30 Dec 2025 10.05 AM	builxejc / builxejc	0644
scanreport-builxejc-Apr_03_2026_06h03m.txt	39.731 KB	3 Apr 2026 11.11 AM	root / root	0644
scanreport-builxejc-Dec_12_2025_02h34m.txt	20.818 KB	12 Dec 2025 8.04 AM	root / root	0644

✘✘ GRAYBYTE WORDPRESS FILE MANAGER @ 2026 CONTACT ME ✘✘