Page 1 of 1

gbook.php Malicious file?

Posted: Sat Dec 10, 2011 1:56 pm
by Davidp
Script URL:
Version of script:
Hosting company:
URL of phpinfo.php:
URL of session_test.php:
What terms did you try when SEARCHING for a solution:

Write your message below:

Hi

I have interated the guest book into my website I have version 1.7 I have been using this on my website for some years now, my hosting company eUKhost.co.uk as removed the file gbook.php for the following reason

Hello ,

Malicious file /home/public_html/g/gbook.php found under your user
and it has been removed on the server merlin.eukhosting.net

==============================================================================
/home/public_html/g/gbook.php:
{HEX}gzbase64.inject.unclassed.14.UNOFFICIAL FOUND
/home/public_html/g/gbook.php: Removed.
==================== ==========================================================

Regards,
Support Team

Now I have replaced the file with a complete new one from the zip file I downloaded from this site but they still say the gbook.php is malicious.

Any got any ideas what they are talking about!!

Re: gbook.php Malicious file?

Posted: Sat Dec 10, 2011 2:08 pm
by Klemen
Here's what's happening:
viewtopic.php?f=7&t=3781

I will see if I can find a work-around for these false warnings - if you would be by any chance prepared to let me access your hosting account to test a few different encoding approaches let me know.

Re: gbook.php Malicious file?

Posted: Sat Dec 10, 2011 3:19 pm
by Klemen
After a few tests this file may fix the problem, upload it instead of original gbook.php file:
http://www.phpjunkyard.com/extras/gbook17_evalfix.zip

If it does fix your problem please let me know.