I believe my web host supplier is runing your program and after loading up an oscommerce addon to my site my hosting account is automatically suspended due to a false positive from the seo.classes.php file?

I’ve taken it up with the host two days in a row now but they run a low cost model and aren’t big on customer service that requires any manual adjustments. I appreciate the fact that they probably have thousands of clients on their servers, but surely there is a way they can easily allow this file to not be automatically quarantined and the account suspended. It doesn’t help my online rep.

I would also suggest that the “Account Suspended” text be changed to something like “Site Offline”. They are both technically correct but the latter is substantially less damaging.

Any advice would be appreciated!

I found a threat that wasn’t detected by maldet.
I tried to upload it with the -c option but I get:

550 Can’t change directory to incoming: Permission denied

Any ideas?
Thanks!

thanks for working hard on the script

I’m on Debian Squeeze (64bit) and am still encountering the same problem as the poster of comment #106, maldet reports that says that there are no inotify processes found.

{mon} no inotify process found, check /usr/local/maldetect/inotify/inotify_log for errors.

The log stays empty and when i manually execute inotifywatch without arguments it seems to run and complains that there are no files specified to watch.

I’ve manually modified maldet to not grep for /home in /etc/passwd but for /var/www (which is my home dir for webhosting users) and it did detect and set inotify to a more reasonable value (instead of 0), however it still reports there are no inotify processes found.

Do you have an idea on how to fix that?

As for the inotify binaries, in 1.4.2 I will add x64 binaries along with a simple check to determine system arch and use the appropriate binaries. I will also add a check to see if the system has its own copy of inotifywatch in $PATH and if so use it.

I hope you and your family are doing well.

We’ve received two separate reports from two different servers showing:

FILE HIT LIST:
{HEX}php.exe.globals.383 : [full path to a directory]

Where it shows scores of directories, but no individual files.

Should I be concerned?

How would I further diagnose this issue?

Thank you.

Here’s my uname -a

Linux xxxxxxxx 2.6.32-32-server #62-Ubuntu SMP Wed Apr 20 22:07:43 UTC 2011 x86_64 GNU/Linux

Couple of bugs I found.

1. tlog doesn’t like /bin/sh under Ubuntu 10.04, changing to /bin/bash seems to fix that.
2. Including and using 32bit bins for inotifywatch and its library really doesn’t help those of us using x64

Any change in an updated version including some logic to use the system version of inotifywatch?

I was just wondering… I dont see options for quiet/verbose. I think this generally standard unix feature would be quite helpful…

For example, I have a nightly cron with email report, something like this:

maldet -d
maldet -u
maldet -r …

and the email is so long with unnecessary info.

I wish there was a way to just have it report the minimal info, without the repeated headers and emails…
something like: maldet -d –quiet
or –noheader

What do you think?

When you set maldet to monitor user’s, does it monitor sub directories under the user home directory?

Thank you.

the last server ist hacked by an unsecure apache with root kit spl.sh :

#!/bin/sh
umask 0
LD_AUDIT=libpcprofile.so PCPROFILE_OUTPUT=/etc/ld.so.preload ping
echo “[+] creating /tmp/getuid.so”
echo “int getuid(){return 0;}” > /tmp/getuid.c
gcc -shared /tmp/getuid.c -o /tmp/getuid.so
echo “/tmp/getuid.so” > /etc/ld.so.preload

So i want to build an hash to parse all files with #!/bin/ or for binaries:

file /bin/bash -> search/scan for ELF \d\d-bit

So which files i have to touch for own hashes ?

hex.dat
md5.dat
rfxn.hdb
rfxn.ndb

so for example want to find files with “#!/bin”

what i have to do ?

md5(#!/bin) -> touch md5.dat and/or rfxn.db ->

0b4962363758288f8f7e0d9cdb413d92:88:{MD5}bash.inject.unclassed.1

0b4962363758288f8f7e0d9cdb413d92:{MD5}bash.inject.unclassed.1

do we need both hex and md5 for this ? thanks for any help with own definitions cause i think not everyone wants to parse #!/bin