Page 1 of 1

file gbook.php deleted

Posted: Thu Jun 05, 2014 6:22 pm
by vintom
Script URL:
Version of script:
Hosting company:
URL of phpinfo.php:
URL of session_test.php:
What terms did you try when SEARCHING for a solution:

Write your message below:
For Information only as problem solved:
After installing and testing the guestbook -which works very well - once a day the guestbook failed to respond to the link calling it. Inspection of the remote host showed that the file gbook.php was missing. The folder gbook indicated that it had been accessed and modified during the small hours.
On checking with the hosting company this was the cause of the problem:

The file was quarantined by "Linux Malware Detect" software running in the server suspecting its malicious.

Jun 05 04:55:52 liberty maldet(86854): {hexstring} malware hit {HEX}gzbase64.inject.unclassed.15 on /home/mdennis2/public_html/gbook/gbook.php
Jun 05 04:55:52 liberty maldet(86854): {quar} malware quarantined from '/home/mdennis2/public_html/gbook/gbook.php' to '/usr/local/maldetect/quarantine/gbook.php.19437'

I asked support to whitelist the folder gbook so hopefully no more problems.

Perhaps this information might be useful to somebody.

Very pleased with the guestbook.

Best regards,

Vintom

Re: file gbook.php deleted

Posted: Sat Jun 07, 2014 11:41 am
by Klemen
Hi,

Here is a post explaining what is happening and offering an alternative file if the changes your host made don't work:
viewtopic.php?f=7&t=3781

In short, this is a false alarm because some malware scanners mark any encoded PHP code as a potential threat because the source code is hidden.