Fabrik = Malware

[gstyles]

Fabrik = Malware NO IT DOESNT! Solved

My Server admin has just sent me this message and I have not a clue what to do about it?

We have recently discovered suspect files in your cpanel account with username xxxxx
Jan 28 02:45:23 apollo cxs[494149]: ['/home/pattesti/public_html/components/com_fabrik/models/element.php'] - Regular expression match = [decode regex: 1] Jan 28 02:45:49 apollo cxs[494149]: ['/home/pattesti/public_html/plugins/content/pagenavigation/fabrik_element/date/date.php'] - Regular expression match = [decode regex: 1] Jan 28 02:45:50 apollo cxs[494149]: ['/home/pattesti/public_html/plugins/content/pagenavigation/fabrik_element/image/image.php'] - Regular expression match = [decode regex: 1] Jan 28 02:45:50 apollo cxs[494149]: ['/home/pattesti/public_html/plugins/content/pagenavigation/fabrik_element/link/link.php'] - Regular expression match = [decode regex: 1] Jan 28 02:46:03 apollo cxs[494149]: ['/home/pattesti/public_html/plugins/fabrik_element/date/date.php'] - Regular expression match = [decode regex: 1] Jan 28 02:46:04 apollo cxs[494149]: ['/home/pattesti/public_html/plugins/fabrik_element/image/image.php'] - Regular expression match = [decode regex: 1] Jan 28 02:46:04 apollo cxs[494149]: ['/home/pattesti/public_html/plugins/fabrik_element/link/link.php'] - Regular expression match = [decode regex: 1]

Any help suggestions would be appreciated. Thanks gws.

 

[felixkat]

Well effectively your host is using something like CXS, which is reporting false positives.

http://configserver.com/cp/cxs.html


The only thing I can suggest is to tell your host their system is wrong!

Any decent host will have a procedure is place to deal with that, even if it means preventing scans on your site until they sort it out.

.

 

[gstyles]

Thanks Felixcat, I have had the server admins on the phone and they have said it was an automatic scan that needs tuning and there is nothing wrong with the files. Thats a relief.

 

[felixkat]

No worries, glad you got it sorted.

You can be sure Fabrik is not malware.