我的主机提供商向我发送了一封电子邮件,它说我的应用程序有一些恶意软件,我应该修复它们,.that电子邮件还包含以下列表:
{YARA}r57shell_php_php : /home/virtfs/username/usr/ local/apache.ea 3/conf/modsec2。user.conf.rpmsave {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/servina_db/qmx72 72_ rsfirewall_signatures.MYI {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/servina_db/qmx72 72_ rsfirewall_signatures.MYD {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/carmane0 0_arman/ar_ redirection_404.MYD {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/carmane0 0_arman/ar_ redirection_404.MYI {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/ofoghdat_rez/iev7c_ rsfirewall_signatures.MYD {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/ofoghdat_rez/iev7c_ rsfirewall_signatures.MYI {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/jammashi_db/i6bm7_ rsfirewall_signatures.ibd {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/iimenlo2_saeed/In8qc_ rsfirewall_signatures.MYD {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/iimenlo2_saeed/In8qc_ rsfirewall_signatures.MYI {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/packagin_db3/l2p08_ rsfirewall_signatures.MYI {YARA}eval_post : /home/virtfs/username/var/lib/ mysql/packagin_db3/l2p08_ rsfirewall_logs.MYD {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/packagin_db3/l2p08_ rsfirewall_signatures.MYD {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/ofoghdat_db/rnghu_ rsfirewall_signatures.ibd {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/ofoghdat_ge/iev7c_ rsfirewall_signatures.MYD {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/ofoghdat_ge/iev7c_ rsfirewall_signatures.MYI {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/iturkey1 1_testsh/vnjca_ rsfirewall_patterns.MYD {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/iturkey1 1_testsh/vnjca_ rsfirewall_patterns.MYI {YARA}r57shell_php_php : /home/virtfs/username/var/lib/ mysql/lemoda_lmag/flsdc_ rsfirewall_signatures.ibd
我在我的应用程序中使用了php,它包含一些简单的SELECT和UPDATE。
我不知道这些是什么,我怎么能修好它们。任何帮助都将不胜感激。谢谢。
发布于 2017-10-24 10:42:13
这很可能是假阳性。
{YARA}r57shell_php_php是Maldet用来猜测恶意软件的模式匹配文件,当它还不确定的时候。
告诉你的主机提供商,一旦你扫描了这些文件,它很可能是个假阳性。
https://stackoverflow.com/questions/44646017
复制相似问题