Malicious Files IN My Cpanel

HeatUpJamz

New member

Nov 28, 2020

25

3

3

• Dec 12, 2020

• #1

I did a scan for virus on my Cpanel after I got hit by A Hacker and I found the files as malicious, So I want to ask from professionals here to know if these files are malicious and should be deleted asap.

/plugins/advanced-ads/classes/plugin.php

/plugins/w3-total-cache/CdnEngine_Ftp.php

/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html

 

tuton012

Strive for progress, not perfection

Babiato Lover

Trusted Uploader

May 23, 2019

1,607

2,060

120

Near You

• Dec 12, 2020

• #2

first, where did you got does plugin from? also did the hacker manages to get into your website? more information will be helpful

 

HeatUpJamz

New member

Nov 28, 2020

25

3

3

• Dec 12, 2020

• #3

Those plugins were Download from WordPress plugin store. But that last plugin I can't really like identify what plugin it is. (If you can identify it, do tell me).

The hacker I think got into my Cpanel changed the login details and also my site, cos my site was down for like some minutes, before I had to Change the login details and do a restore backup.

 

T

TassieNZ

Premium Uploader and Sometimes Hacker!

Jan 17, 2019

9,017

19,812

120

New Zealand

• Dec 12, 2020

• #4

The third plugin is:

File Manager

file manager provides you ability to edit, delete, upload, download, copy and paste files and folders.

wordpress.org

If you had an older version than 6.9 that is possibly how they got in as it had a major security flaw!

 

HeatUpJamz

New member

Nov 28, 2020

25

3

3

• Dec 12, 2020

• #5

TassieNZ said:

The third plugin is:

File Manager

file manager provides you ability to edit, delete, upload, download, copy and paste files and folders.

wordpress.org

If you had an older version than 6.9 that is possibly how they got in as it had a major security flaw!

Click to expand...

But I use the updated File Manager plugin, Version 6.9 that's the current version I'm on.

 

• 

Reactions: TassieNZ

T

TassieNZ

Premium Uploader and Sometimes Hacker!

Jan 17, 2019

9,017

19,812

120

New Zealand

• Dec 12, 2020

• #6

HeatUpJamz said:

But I use the updated File Manager plugin, Version 6.9 that's the current version I'm on.

Click to expand...

O.K. Was just a thought as I know that plugin had issues. May well be a server related hacking, especially as password access had been changed.

Would have been useful to save the infected files (did you?), then zip them and post them. Then we can look at the code.

 

• 

Reactions: PExplorer

HeatUpJamz

New member

Nov 28, 2020

25

3

3

• Dec 12, 2020

• #7

TassieNZ said:

O.K. Was just a thought as I know that plugin had issues. May well be a server related hacking, especially as password access had been changed.

Would have been useful to save the infected files (did you?), then zip them and post them. Then we can look at the code.

Click to expand...

Yes I saved them in my public html I just had to copy them out to ask for you guys opinion