malware warning

Gb59 · Post by **Gb59** » Tue Jul 24, 2012 11:41 pm

Script URL:
Version of script: 1.5
Hosting company: hawkhost
URL of phpinfo.php:
URL of session_test.php:
What terms did you try when SEARCHING for a solution:

Write your message below:

There is malware warning: (malet scanner)
{HEX}gzbase64.inject.unclassed.14 : /home/.../MyGbook.php

I think this is false alarm .. is there a way I can download a fresh 1.5 guestbook file?

Gb59 · Post by **Gb59** » Wed Jul 25, 2012 2:30 am

I read here there is a false positive fix for 1.7 - can I have that for v1.5?

viewtopic.php?f=7&t=3781

Post by **Klemen** » Wed Jul 25, 2012 9:24 am

I'm afraid I don't provide support for such old versions anymore. You are encouraged to upgrade to 1.7 instead.

If you wish to keep your old version you will probably need to contact your hosting company and ask them to add your gbook.php file to their antivirus software "ignore" list.

Gb59 · Post by **Gb59** » Wed Jul 25, 2012 8:15 pm

I tried 1.7 but the upgrade is incompatible with the customisations in header/footer.txt hence can't do that.

fugitivewife · Post by **fugitivewife** » Mon Aug 06, 2012 2:40 pm

I have been using the guestbook for quite awhile now and all of a sudden my host provider send me this message:

*********
Your account is hosting the follwoing malicious files/scripts :
{HEX}gzbase64.inject.unclassed.14 : /home/......./gbook.php
This files are being abused by crackers/hackers to install malicious scripts on your account. Please note that our servers are up to date and monitored frequently against these hack/malicious attempts.
We have disabled the public_html folder for this account(s) temporarily to avoid any further exploits. This has been done for your own safety as well as to protect everyone else on the server and internet to make it a safe place for all.
********
I removed the one offending file that they pointed too but now they are telling me that ALL the gbook.php files are "infected". I have over 20 guestbooks running on this server and have had them for quite awhile. I also have the newest version 1.7.

I saw the code fix above and I assume that is the gbook.php file in the current download. I was working on a new guestbook when I got flagged as being malicious. lol I am NOT malicious.

Any ideas, what might be going on? I would hate to have to change guestbooks!

Gb59 · Post by **Gb59** » Mon Aug 06, 2012 8:20 pm

As posted above it's a false positive - the code base64 part (inside the php code) is seen as malicious injection by most scanners hence this file is flagged.

My host has accepted that the code is clean

fugitivewife · Post by **fugitivewife** » Tue Aug 07, 2012 2:22 pm

Gb59, who is your host. Mine is still giving me the run around telling me that they can exclude me from the scanner so I can run my guestbooks. Not sure that is an option I want to go with. I HATE communicating computer for tech support, as this has been going on for two days and my guestbooks are STILL not back online. Waiting for hours for an answer to simple questions and then getting an answer that only addresses one of them is starting to really irratate me.

Post by **Klemen** » Tue Aug 07, 2012 2:28 pm

Yes, unfortunately it is a false positive. Some virus scanners just block any script that uses this encoding technique. The "evalfix" file should be used as a solution in such cases.

Gb59 · Post by **Gb59** » Tue Aug 07, 2012 7:32 pm

My host is Hawkhost.com and my guestbook v1.5 actually never was off-line. Talk to them upfront!

PHPJunkyard support forum

malware warning

malware warning

Re: malware warning

Re: malware warning

Re: malware warning

Re: malware warning

Re: malware warning

Re: malware warning

Re: malware warning

Re: malware warning