The danger of hacking is a very serious concern. That’s why it’s crucial to focus on securing your cPanel account and also the ability to read your scan report.
Our Shared Hosting servers have a strong firewall system and other security measures. However, the safety of your cPanel account also relies on you. By checking your hosting space for viruses, trojans, malware, and other dangers, you maintain its protection.
To discover any harmful software in your cPanel, utilize the built-in cPanel Virus Scanner or get in touch with our Support Team. We’ll conduct a scan of your hosting account whenever you need to make sure it’s safe and free of threats. We’ll provide a detailed report for you to review.
How to Locate Your Scan Report
Once the scanning process is complete, a report is uploaded automatically to your cPanel account. To locate it, follow the steps below:
1. Log in to your cPanel.
2. Navigate to the Files section >> File Manager:
Usually, its name contains your cPanel username and the date when the file was generated, e.g., scanreport-nctest-Mar_17_2020_16h_53m.txt.
4. Locate the file, right-click >> choose the Edit option.
The scan report will be opened in a new browser window. Now you are ready to examine it.
How to Read Your Scan Report
----------- SCAN REPORT ----------- TimeStamp: Wed, 26 Feb 2020 01:31:39 -0500 (/usr/sbin/cxs --background --nobayes --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 10000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --qoptions Mv --report /home/cPanel_username/scan_report_Feb-26-2020 --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user cPanel_username --virusscan --xtra /etc/cxs/cxs.xtra.manual) Scanning /home/cPanel_username: '/home/cPanel_username/.bcwfgi.php' # ClamAV detected virus = [YARA.php_malware_hexinject.UNOFFICIAL] '/home/cPanel_username/old/wp-admin/cfgs.php' # Known exploit = [Fingerprint Match] [PHP Exploit] '/home/cPanel_username/old/wp-admin/images/align-lefts.png' # Suspicious image file (hidden script file) '/home/cPanel_username/public_html/assets/asset/js/plugins/editors/codemirror/mode/clike/index.html' # Suspicious file type [application/x-c] '/home/cPanel_username/public_html/assets/asset/js/plugins/uploaders/plupload/files/Moxie.xap' # (compressed file: Moxie.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec] '/home/cPanel_username/public_html/vendor/laravel/framework/src/Illuminate/Filesystem/Filesystem.php' # Regular expression match = [symlink\s*\(] '/home/cPanel_username/example.com/wp-content/plugins/contact-form-7/wp-contact-form-7.php' # Script version check [OLD] [Contact Form 7 v5.0.5 < v5.1.3] '/home/cPanel_username/example.com/wp-content/themes/weddingvero/auto-install/uploads/espresso/tickets' # World writeable directory ----------- SCAN SUMMARY ----------- Scanned directories: 8221 Scanned files: 77818 Ignored items: 217 Suspicious matches: 893 Viruses found: 743 Fingerprint matches: 85 Data scanned: 5245.76 MB Scan time/item: 0.013 sec Scan time: 1149.580 sec
- path to the directory or file (e.g. ‘/home/cPanel_username/public_html/vendor/laravel/framework/src/Illuminate/Filesystem/Filesystem.php’) ;
- scan result (e.g. # Regular expression match = [symlink\s*\(]).
Considering the scan results, there are specific steps you should take to maintain the security of your account. Many situations are explained in the table provided:
IMPORTANT 1: Before making any changes, be sure to create a backup of your cPanel.
IMPORTANT 2: Files with names randomly generated (e.g. bcwfgi.php) usually contain harmful code. These files don’t belong to any CMS and should be removed.
| Result | Description | Action to take |
|---|---|---|
| # ClamAV detected virus | Antivirus software has found a potentially dangerous file with malware. | Remove a file. |
| # Suspicious file type [application/x-c]
# MS Windows Binary/Executable [application/x-winexec] # (compressed file: Moxie.dll [depth: 1]) MS Windows # Binary/Executable [application/x-winexec] # MS-DOS Binary/Executable [application/x-dosexec] |
Antivirus software has found Windows binary or executable files.
Such files cannot be executed on a Linux-based OS. You would not You can discover a Trojan file among them. |
Remove a file. |
| # Linux Binary/Executable [application/x-sharedlib] | Antivirus software has found Linux binary or executable files. Such files can be executed on a Linux-based OS. Still, you would not normally expect to find one within a cPanel account. If a Linux binary or executable file is located in a cPanel account, it is most likely an exploit that remains hidden. |
Remove a file. |
| # Known exploit = [Fingerprint Match] | Antivirus software considers a file as an exploit. An exploit can be a program, a piece of code, or even just a string of characters. It takes advantage of a program. Then, this program acts in an unexpected way, which results in undesirable behavior. Also, exploits are maliciously used to gain unauthorized access. |
Unless you know the purpose of this file, remove it from your cPanel. If it is related to installed software and you need it, either clean it or upload again from a trusted source. PLEASE NOTE: It is strongly encouraged to use content only from the official source. |
| # Symlink to | The file is a symbolic link.
It consists of a special type of file that serves as a reference to another file or directory. Some default files require symlinks for the proper work of cPanel services: ‘/home/cPanel_username/.cagefs/opt/alt/phpXX/link/conf’ But the custom symlinks (e.g. a symlink to files outside of your cPanel account) may cause serious security breaches. |
Pay attention to the custom symlinks. Such files should be removed from your account.
Symlinks to default cPanel files can be ignored. |
| # Socket | A socket is typically used to transfer data between two separate processes. You would not expect to normally find one within a cPanel account. | Unless you know the purpose of this file or it is related to the software installed from the trusted source, remove it from your cPanel. |
| # Regular expression match = [symlink\s*\(] | A file contains ‘symlink(s)’ expression as a comment or variable. | It is a false-positive. The file can be ignored. |
| # Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd] | A file contains ‘/etc/passwd’ expression as a comment or variable. | It is a false-positive. The file can be ignored. |
| # Regular expression match = [\n(?!\s*(//|\#|\*)).*\.ssh/] | A file contains ‘/.ssh’ expression as a comment or variable. Such files are potentially harmful to your account as they allow remote access using SSH keys. | Unless you know the purpose of this file or it is related to the software installed from the trusted source, remove it from your cPanel. |
| # Universal decode regex match | A file contains some string encoded with a common encoder, e.g. base64. They are often used to hide malicious code. | Unless you know the purpose of this file or it is related to the software installed from the trusted source, remove it from your cPanel. |
| # Script version check [OLD] | The installation, plugin or theme version is outdated. Software updates are important because they check for the bugs and vulnerabilities found in the previous versions. A ‘hole’ in one can affect your entire installation as well as your cPanel account. | Ensure that your installations are up to date. |
| # World writeable directory | Permissions for a directory are set to 777.
It is recommended to have default permissions assigned to website files and folders. However, it is safe to have permissions set to 777 for default cPanel folders: /home/cPanel_user/.cagefs/var/cache |
Update permissions for the indicated directory. |
| # Scan Timeout (30 seconds) while processing | The scan process has been interrupted. | You can put in a request to our Support Team to scan it additionally. |
After implementing all the necessary steps, it’s time to generate a current backup of your account. You can accomplish this effortlessly using the built-in backup tool found in your cPanel. For more information, refer to the article provided below.
And that’s all!
