Recent Posts

Pages: 1 ... 8 9 [10]
91
เรื่องส่วนตัว เก็บไว้อ่านเอง / วิธีติดตั้ง PHP หลายเวอร์ชั่นบน DirectAdmin
« Last post by Ralphbut on April 17, 2020, 04:04:16 PM »
ธีติดตั้งเวอร์ชัน PHP หลายเวอร์ชันบน DirectAdmin

DirectAdmin มีการสนับสนุนสำหรับการใช้งานเวอร์ชัน PHP 2 เวอร์ชันควบคู่ไป ปัจจุบันใช้งานร่วมกันที่นิยมมากที่สุดคือ PHP 5.6 และ 7.2
ก่อนที่จะทำตามบทแนะนำนี้ คุณจะต้องตรวจสอบให้แน่ใจว่าคุณใช้งาน CustomBuild 2.0 อยู่ หากไม่เป็นเช่นนั้นโปรดตรวจสอบและอัปเดต คลิกที่นี่ เพื่อดูวิธีตรวจสอบ CustomBuild Versions / และ วิธีอัพเกรด CustomBuild 2.0

 

Step 1 เปิดไฟล์ options.conf :

cd /usr/local/directadmin/custombuild   // เปลี่ยนพารามิเตอร์
vi options.conf  // เปิดไฟล์ options.conf เพื่อแก้ไข
 

Step 2  แก้ไฟล์คอนฟิกของไฟล์ options.conf

php1_release=7.0
php1_mode=php-fpm
php2_release=5.6
php2_mode=php-fpm
 

Step 3 เริ่มทำการคอมไพล์ โดยใช้คำสั่งดังต่อไปนี้

./build php n
./build rewrite_confs
 

Step 4 ไปที่ส่วนของ PHP Version Selector โดยสามารถเลือกได้ 2 เวอร์ชั่นด้วยกัน

4.1 First PHP : php เวอร์ชั่นหลัก (ในที่นี้เลือก PHP7 )

4.2 Second PHP : php เวอร์ชั่นรอง (ในที่นี้เลือก PHP5.3 )

4.3 ขั้นตอนสุดท้าย กด " Save "

92
รีวิวร้านอาหารอร่อยๆ กรุงเทพ / Re: รีวิว ร้านอาหาร ช่วง Covid-19 stay at home สาธุประดิษฐ์ พระราม3 ถนนจันทน์
« Last post by Ralphbut on April 11, 2020, 01:34:17 PM »








93
รีวิวร้านอาหารอร่อยๆ กรุงเทพ / รีวิว ร้านอาหาร ช่วง Covid-19 stay at home สาธุประดิษฐ์ พระราม3 ถนนจันทน์
« Last post by Ralphbut on April 11, 2020, 01:09:34 PM »





















94
เรื่องส่วนตัว เก็บไว้อ่านเอง / Resetting Windows 10 ไม่ได้ครับ ขอคำแนะนำด้วยครับ
« Last post by Ralphbut on April 09, 2020, 08:06:55 PM »
  There was a problem resetting your pc  No change were made

วิธีแก้ของผมที่ผมทำแล้วมันได้ผล
1. ไปโหลดตัว MediaCreationTool มา https://www.microsoft.com/en-us/software-download/windows10
2. โหลดเสร็จแล้ว ก็เปิด MediaCreationTool ให้เลือก Create installation media for another PC กด Next

3. มันจะให้เลือกเวอร์ชั่นของ Windows 10 ปกติมันจะกำหนดค่ามาให้อยู่แล้ว
ถ้าถูกต้องก็กด Next ถ้าไม่ถูกก็เอาติ๊ก Use the recommended option for this PC ออกก่อน แล้วก็เลือกเวอร์ชั่นของตัวเอง
ของผมตรง Edition ผมคิดว่ามันไม่ถูกนะ มันเป็นคำว่า Windows 10 เฉยๆ (ไม่มี Home,Pro ต่อท้าย)
พอกดดูแล้วมันก็ไม่มีเวอร์ชั่น Home Single Language ขึ้นให้ วิธีแก้ ก็เลือกเป็นภาษาอื่นก่อนแล้วค่อยกลับมาเป็น UK แค่นี้ก็หายแล้ว
(เช็คเวอร์ชั่น Windows ได้โดย กดปุ่ม Windows + R ใช้คำสั่ง winver จากนั้นอ่านเอาในหน้าต่าง About Windows)

ตัวอย่างของผม
Language : English (United Kingdom)
Edition : Windows 10 Home Single Language
Architecture : 64-bit (x64)
*ผมก็ไม่แน่ใจว่าใช้เวอร์ชั่นอื่นที่ไม่ตรงกับของเราแทนได้รึเปล่ายังไม่เคยลอง แต่แนะนำให้เลือกตรงกับรุ่นตัวเองดีที่สุด
และถ้าถามว่าเลือกภาษาอื่นได้มั๊ย ทำไมต้องเป็น English (United Kingdom) ผมคิดว่า UK เหมาะสุดเพราะว่าเป็นภาษาเริ่มต้นไม่น่ามีปัญหา

4. ขั้นตอนนี้จะให้เลือกว่าไฟล์จะไปอยู่ในรูปแบบอะไร มี 2 ตัวเลือก USB flash drive กับ ISO file

- USB flash drive (ต้องใช้ความจุ 3 GB ขึ้นไป) คือถ้ามี flash drive เปล่าๆวางใกล้ๆตัวแล้วรีบก็เลือกแบบนี้ได้เลย
ตัวโปรแกรมจะจัดการไฟล์ Windows ลง flash drive ให้เลย (และไม่น่าจะได้ไฟล์ .iso เก็บไว้) https://youtu.be/SBvN1v6rvqk

- ISO file ไฟล์ Windows ที่ดาวน์โหลดจะได้เป็นไฟล์ .iso แล้วจากนั้นจะเอาไปไรท์ใส่แผ่น หรือเอาลง flash drive ทีหลังก็ได้
(ผมว่าเลือกแบบนี้ดีกว่า) กด Next มันจะให้เลือกว่าให้เอาไฟล์ไปไว้ที่ไหน เลือกเสร็จแล้วกด Save
จากนั้นก็รอโหลด Progress: 100% โหลดเสร็จแล้วก็กด Finish ไป https://youtu.be/PdQHe2Dv4QU
ไรท์ลงแผ่นก็ใช้คลิกขวาที่ไฟล์ > Burn Disc Image หรือใช้โปรแกรมอื่น nero etc. ตามสะดวก
ถ้าเอาลง flash drive ต้องใช้โปรแกรม Windows 7 USB DVD Download Tool โหลดที่ http://wudt.codeplex.com/

5.จัดการไฟล์ลงแผ่น dvd หรือ flash drive ให้เรียบร้อย จากนั้นก็ตั้งให้มัน boot เข้า flash drive
ก็เหมือนลง windows จากแผ่นนั่นแหละ http://pantip.com/topic/31149470

6.ขั้นตอนก็เหมือนติดตั้ง windows ตามปกติ ถ้าขึ้นให้ใส่ product key ก็กด skip หรือ i don't have a product key ไปก่อน
ตอนจะติดตั้งให้เลือก partition เป็น drive C เดิมนั่นแหละครับ ฟังไม่ผิดหรอก คือให้ลงทับ Windows อันเก่าไปเลย
และไม่ต้อง Format นะครับ ให้ลงทับไปเลย (ผมคิดว่าคีย์มันจะหลุดก็เพราะ Format ก่อนนี่แหละ)
จากนั้นรอผล เมื่อติดตั้งเสร็จแล้ว ให้เชื่อมต่ออินเทอร์เน็ต จะ LAN หรือ WIFI ก็แล้วแต่
(เพราะก่อนติดตั้งเรากด Skip มันตรง product key ก็เลยต้องต่อเน็ตเพื่อให้มัน activate product key ที่อยู่ในเครื่องก่อน)
คลิกขวา This PC > Properties ดูตรง Windows activation ถ้าเขียนว่า Windows is activated...

ก็แปลว่า ผ่าน!!! สิครับ คีย์เดิมยังอยู่ ตอนแรกใจเสียเลย เสียดายมากนึกว่าบิน จะได้กลับไปใช้ 8.1 ซ่ะแล้ว พอได้นี่แทบกระโดด
ยังไม่พอนะครับทดสอบอีกติดตั้ง 2-3 โปรแกรม จากนั้นลอง Reset this PC ผลคือ ใช้ได้ปกติครับ!! สบายใจมากตอนนี้

ใครลองวิธีผมแล้วใช้ได้ก็ยินดีด้วยครับ
95
รีวิวร้านอาหาร / GON Happy Hour มาแล้ววว💚 1 แถม 1 เฉพาะสั่งผ่าน #LINEMAN เท่านั้น!! ถูกขนาดนี้ไม
« Last post by Ralphbut on April 06, 2020, 09:40:20 AM »
GON Happy Hour มาแล้ววว💚 1 แถม 1 เฉพาะสั่งผ่าน #LINEMAN เท่านั้น!! ถูกขนาดนี้ไม่สั่งอดใจไหวหรอ...
📌 สั่งเลย Line Man >>> https://lineman.onelink.me/1N3T/672cf799

✅ซื้อ 1เซ็ต แถม 1เซ็ต บูตะมีลเซ็ต+เกี๊ยวซ๋า+Pepsi เพียง 225.-

✅ซื้อ 1เซ็ต แถม 1เซ็ต ข้าวหมูทอดกระเทียม+เกี๊ยวซ๋า+ Pepsi เพียง 165.-

✅ซื้อ 1เซ็ต แถม 1เซ็ต อูด้งผัดซอสมิโสะ+เกี๊ยวซ๋า+Pepsi เพียง 185.-

ระยะเวลาโปรโมชั่นวันที่ 1-6 เม.ย. 63 เฉพาะช่วงเวลาตั้งแต่ 13:00 -17:00 น.

✅ซื้อ 1 แถม 1 ยำหมูยอไข่เค็ม เพียง 89.-

ระยะเวลาโปรโมชั่นวันที่ 1-14 เม.ย. 63 เฉพาะช่วงเวลาตั้งแต่ 13:00 -17:00 น.

🥰ดาวน์โหลดเมนูสำหรับ Take Home และ Delivery คลิกเลยคร้าบบบบ >>> https://bit.ly/39nIDkr

🎯 เช็กสาขาที่ให้บริการรูปแบบ Take home และ Delivery ทั้งหมด 34 สาขาคลิกที่นี่เลยคร้าบบ>>> https://bit.ly/398D09B

#gondelivery #gontakehome
#BBQPLAZAXLINEMAN
#บาร์บีคิวพลาซ่า
96
เรื่องส่วนตัว เก็บไว้อ่านเอง / ประกันไวรัส Covic-19
« Last post by Ralphbut on March 16, 2020, 12:26:39 PM »
1) Kplus : https://www.kasikornbank.com/th/promotion/Pages/Covid19.aspx
2) UOB line connect : https://www.uob.co.th/perso…/covid19/covid-landing-mass.page
https://www.uob.co.th/personal/covid19/covid-landing-mass.page?fbclid=IwAR0P2iQimn2nJsqMU4luMBks5yOpKqpVsAkw02jEDxWArWE48x-O0HBQFoU

3) ลูกค้าเมืองไทยประกันชีวิต : https://www.muangthai.co.th/news/view/covid-19
4) ลูกค้า True : https://privilege.trueid.net/…/merchan…/trueyou/Ay2aBQ0xvGRj
https://privilege.trueid.net/th/privileges/%E0%B8%A5%E0%B8%B9%E0%B8%81%E0%B8%84%E0%B9%89%E0%B8%B2%E0%B8%97%E0%B8%A3%E0%B8%B9%E0%B8%A1%E0%B8%B9%E0%B8%9F%E0%B9%80%E0%B8%AD%E0%B8%8A-%E0%B9%81%E0%B8%9A%E0%B8%9A%E0%B8%A3%E0%B8%B2%E0%B8%A2%E0%B9%80%E0%B8%94%E0%B8%B7%E0%B8%AD%E0%B8%99-%E0%B8%97%E0%B8%A3%E0%B8%B9%E0%B8%A7%E0%B8%B4%E0%B8%8A%E0%B8%B1%E0%B8%99%E0%B8%AA%E0%B9%8C-%E0%B8%97%E0%B8%A3%E0%B8%B9%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C-%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B8%9F%E0%B8%A3%E0%B8%B5-%E0%B8%84%E0%B8%A7%E0%B8%B2%E0%B8%A1%E0%B8%84%E0%B8%B8%E0%B9%89%E0%B8%A1%E0%B8%84%E0%B8%A3%E0%B8%AD%E0%B8%87%E0%B9%84%E0%B8%A7%E0%B8%A3%E0%B8%B1%E0%B8%AA%E0%B9%82%E0%B8%84%E0%B9%82%E0%B8%A3%E0%B8%99%E0%B9%88%E0%B8%B2-covid-19-%E0%B8%AA%E0%B8%B9%E0%B8%87%E0%B8%AA%E0%B8%B8%E0%B8%94-100-000-%E0%B8%9A%E0%B8%B2%E0%B8%97-%E0%B8%99%E0%B8%B2%E0%B8%99-30-%E0%B8%A7%E0%B8%B1%E0%B8%99/98Rjb5RjXO18?merchantId=Ay2aBQ0xvGRj

5) ลูกค้าAIA : https://www.aia.co.th/…/…/novel-coronavirus-extra-cover.html
https://www.aia.co.th/th/help-support/unexpected-health-issues/novel-coronavirus-extra-cover.html?fbclid=IwAR2iSMHNYMIN02bBGqiqjv14APbyygoSSaoqzN1U0iGLHla8OAR6ngcy9qw

6) เอเชีย : โทร 02-869-3399
7) ไทยไพบูลย์ : โทร 02-209-3299
8) ทิพยประกันภัย : https://www.tipinsure.com/Ph/step_1
9) สินมั่นคง : https://www.smk.co.th/producthealthdetail/13
10) วิริยะ : https://insure.724.co.th/campaign/covid-viriyah
11) เมืองไทยประกันภัย : https://www.muangthaiinsurance.com/th/product/detail/52
12) สินทรัพย์ประกันภัย : https://www.asset.co.th/product.php?id=16
13) ไทยประกันภัย : https://pchangonline.com/covid
14) JP Insurance : https://jpinsurancecovid19.jpinsurancefriend.com/page2
15) SCB แผน A Covid-19 Care : https://www.scb.co.th/…/person…/insurance/covid19/deves.html
16) SCB แผนB Covid-19 Plus : https://www.scb.co.th/…/person…/insurance/covid19/deves.html
17) กรุงเทพประกันภัย : https://www.tqm.co.th/…/แผนประกันไวรัสโคโรนาของกรุงเทพประกั…
97
เรื่องส่วนตัว เก็บไว้อ่านเอง / Re: ติดตั้ง ClamAV ใน Directadmin และเพิ่ม rule พิเศษสำหรับค้าหา PHP Backdoor
« Last post by Ralphbut on February 18, 2020, 10:51:27 AM »
[root@ns1 ~]# clamscan -ri --move=/tmp/virus /home/vouchercar/
/home/vouchercar/domains/vouchercar.com/public_html/xn--12ct0cvb8bzaj8azf2d/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/xn--12ct0cvb8bzaj8azf2d/jvc.php: moved to '/tmp/virus/jvc.php'
/home/vouchercar/domains/vouchercar.com/public_html/sitemap/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/sitemap/jvc.php: moved to '/tmp/virus/jvc.php.001'
/home/vouchercar/domains/vouchercar.com/public_html/js/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/js/jvc.php: moved to '/tmp/virus/jvc.php.002'
/home/vouchercar/domains/vouchercar.com/public_html/https/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/https/jvc.php: moved to '/tmp/virus/jvc.php.003'
/home/vouchercar/domains/vouchercar.com/public_html/admin/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/admin/jvc.php: moved to '/tmp/virus/jvc.php.004'
/home/vouchercar/domains/vouchercar.com/public_html/location/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/location/jvc.php: moved to '/tmp/virus/jvc.php.005'
/home/vouchercar/domains/vouchercar.com/public_html/lib/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/lib/jvc.php: moved to '/tmp/virus/jvc.php.006'
/home/vouchercar/domains/vouchercar.com/public_html/thaiteawthai/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/thaiteawthai/jvc.php: moved to '/tmp/virus/jvc.php.007'
/home/vouchercar/domains/vouchercar.com/public_html/line/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/line/jvc.php: moved to '/tmp/virus/jvc.php.008'
/home/vouchercar/domains/vouchercar.com/public_html/en/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/en/jvc.php: moved to '/tmp/virus/jvc.php.009'
/home/vouchercar/domains/vouchercar.com/public_html/b/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/b/jvc.php: moved to '/tmp/virus/jvc.php.010'
/home/vouchercar/domains/vouchercar.com/public_html/q/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/q/jvc.php: moved to '/tmp/virus/jvc.php.011'
/home/vouchercar/domains/vouchercar.com/public_html/xn--12ct1bl5be1e7al8bzg3b3c/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/xn--12ct1bl5be1e7al8bzg3b3c/jvc.php: moved to '/tmp/virus/jvc.php.012'
/home/vouchercar/domains/vouchercar.com/public_html/images/deal/deal727.php: {HEX}php.malware.fopo.547.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/images/deal/deal727.php: moved to '/tmp/virus/deal727.php'
/home/vouchercar/domains/vouchercar.com/public_html/images/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/images/jvc.php: moved to '/tmp/virus/jvc.php.013'
/home/vouchercar/domains/vouchercar.com/public_html/webboard/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/webboard/jvc.php: moved to '/tmp/virus/jvc.php.014'
/home/vouchercar/domains/vouchercar.com/public_html/mobile/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/mobile/jvc.php: moved to '/tmp/virus/jvc.php.015'
/home/vouchercar/domains/vouchercar.com/public_html/en3/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/en3/jvc.php: moved to '/tmp/virus/jvc.php.016'
/home/vouchercar/domains/vouchercar.com/public_html/d/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/d/jvc.php: moved to '/tmp/virus/jvc.php.017'
/home/vouchercar/domains/vouchercar.com/public_html/usb/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/usb/jvc.php: moved to '/tmp/virus/jvc.php.018'
/home/vouchercar/domains/vouchercar.com/public_html/html/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/html/jvc.php: moved to '/tmp/virus/jvc.php.019'
/home/vouchercar/domains/vouchercar.com/public_html/member/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/member/jvc.php: moved to '/tmp/virus/jvc.php.020'
/home/vouchercar/domains/vouchercar.com/public_html/bank/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/bank/jvc.php: moved to '/tmp/virus/jvc.php.021'
/home/vouchercar/domains/vouchercar.com/public_html/mobiledetect/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/mobiledetect/jvc.php: moved to '/tmp/virus/jvc.php.022'
/home/vouchercar/domains/vouchercar.com/public_html/redomain/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/redomain/jvc.php: moved to '/tmp/virus/jvc.php.023'
/home/vouchercar/domains/vouchercar.com/public_html/cat/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/cat/jvc.php: moved to '/tmp/virus/jvc.php.024'
/home/vouchercar/domains/vouchercar.com/public_html/email/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/email/jvc.php: moved to '/tmp/virus/jvc.php.025'
/home/vouchercar/domains/vouchercar.com/public_html/sym.php: {HEX}php.malware.fopo.547.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/sym.php: moved to '/tmp/virus/sym.php'
/home/vouchercar/domains/vouchercar.com/public_html/admin2/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/admin2/jvc.php: moved to '/tmp/virus/jvc.php.026'
/home/vouchercar/domains/vouchercar.com/public_html/facebook/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/facebook/jvc.php: moved to '/tmp/virus/jvc.php.027'
/home/vouchercar/domains/vouchercar.com/public_html/store/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/store/jvc.php: moved to '/tmp/virus/jvc.php.028'
/home/vouchercar/domains/vouchercar.com/public_html/ckeditor/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/ckeditor/jvc.php: moved to '/tmp/virus/jvc.php.029'
/home/vouchercar/domains/vouchercar.com/public_html/linepay/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/linepay/jvc.php: moved to '/tmp/virus/jvc.php.030'
/home/vouchercar/domains/vouchercar.com/public_html/store2014/jvc.php: {HEX}php.uploader.max.706.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/store2014/jvc.php: moved to '/tmp/virus/jvc.php.031'

----------- SCAN SUMMARY -----------
Known viruses: 6760167
Engine version: 0.101.2
Scanned directories: 5738
Scanned files: 75817
Infected files: 34
Data scanned: 631.10 MB
Data read: 1260.82 MB (ratio 0.50:1)
Time: 485.736 sec (8 m 5 s)
98
เรื่องส่วนตัว เก็บไว้อ่านเอง / Re: ติดตั้ง ClamAV ใน Directadmin และเพิ่ม rule พิเศษสำหรับค้าหา PHP Backdoor
« Last post by Ralphbut on February 17, 2020, 09:33:48 AM »
[root@ns1 ~]#  clamscan -ri --move=/tmp/virus /home
/home/teradev/domains/teraconsultant.com/public_html/wp-admin/options-style.php: {HEX}Malware.Expert.generic.base64.decode.1.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/wp-admin/options-style.php: moved to '/tmp/virus/options-style.php.001'
LibClamAV Warning: SWF: declared output length != inflated stream size, 149759 != 149763
LibClamAV Warning: SWF: declared output length != inflated stream size, 145931 != 145935
99
เรื่องส่วนตัว เก็บไว้อ่านเอง / Re: ติดตั้ง ClamAV ใน Directadmin และเพิ่ม rule พิเศษสำหรับค้าหา PHP Backdoor
« Last post by Ralphbut on February 16, 2020, 11:27:36 AM »
/home/vouchercar/imap/vouchercar.com/sales/Maildir/new/1581669970.H208694P27899.ns1.thaidreamhost.com: Win.Malware.Generic-7586959-0 FOUND
/home/vouchercar/imap/vouchercar.com/sales/Maildir/new/1581669970.H208694P27899.ns1.thaidreamhost.com: moved to '/tmp/virus/1581669970.H208694P27899.ns1.thaidreamhost.com'
/home/vouchercar/domains/vouchercar.com/private_html/images/category/category45.php: {HEX}Malware.Expert.generic.uploader.78.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/private_html/images/category/category45.php: moved to '/tmp/virus/category45.php'
/home/vouchercar/domains/vouchercar.com/private_html/mobile/leaf.php: {HEX}php.malware.fopo.547.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/private_html/mobile/leaf.php: moved to '/tmp/virus/leaf.php'
/home/vouchercar/domains/vouchercar.com/public_html/https/images/category/category45.php: {HEX}Malware.Expert.generic.uploader.78.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/https/images/category/category45.php: moved to '/tmp/virus/category45.php.001'
/home/vouchercar/domains/vouchercar.com/public_html/https/mobile/leaf.php: {HEX}php.malware.fopo.547.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/https/mobile/leaf.php: moved to '/tmp/virus/leaf.php.001'
/home/vouchercar/domains/vouchercar.com/public_html/wp-logout.php: {HEX}Malware.Expert.generic.malware.144.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/wp-logout.php: moved to '/tmp/virus/wp-logout.php'
/home/vouchercar/domains/vouchercar.com/public_html/images/upload/upload150.php: {HEX}Malware.Expert.mr.dellationx196.bogor.blackhat.1.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/images/upload/upload150.php: moved to '/tmp/virus/upload150.php'
/home/vouchercar/domains/vouchercar.com/public_html/images/upload/wso.php: {HEX}php.shell.black-id.700.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/images/upload/wso.php: moved to '/tmp/virus/wso.php'
/home/vouchercar/domains/vouchercar.com/public_html/images/category/category45.php: {HEX}Malware.Expert.generic.uploader.78.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/images/category/category45.php: moved to '/tmp/virus/category45.php.002'
/home/vouchercar/domains/vouchercar.com/public_html/mobile/leaf.php: {HEX}php.malware.fopo.547.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/mobile/leaf.php: moved to '/tmp/virus/leaf.php.002'
/home/vouchercar/domains/vouchercar.com/public_html/redomain/model/admin.productsetting.php: {HEX}Malware.Expert.generic.eval.21.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/redomain/model/admin.productsetting.php: moved to '/tmp/virus/admin.productsetting.php'
/home/vouchercar/domains/vouchercar.com/public_html/redomain/template3_old_files.tgz: {HEX}Malware.Expert.generic.eval.21.UNOFFICIAL FOUND
/home/vouchercar/domains/vouchercar.com/public_html/redomain/template3_old_files.tgz: moved to '/tmp/virus/template3_old_files.tgz'
/home/rackwell/domains/rackwell.com/public_ftp/incoming/menu_settings.php: {HEX}Malware.Expert.generic.malware.118.UNOFFICIAL FOUND
/home/rackwell/domains/rackwell.com/public_ftp/incoming/menu_settings.php: moved to '/tmp/virus/menu_settings.php'
/home/rackwell/domains/rackwell.com/public_ftp/incoming/system_m.php: {HEX}Malware.Expert.generic.malware.124.UNOFFICIAL FOUND
/home/rackwell/domains/rackwell.com/public_ftp/incoming/system_m.php: moved to '/tmp/virus/system_m.php'
/home/rackwell/domains/rackwell.com/.htpasswd/menu_settings.php: {HEX}Malware.Expert.generic.malware.118.UNOFFICIAL FOUND
/home/rackwell/domains/rackwell.com/.htpasswd/menu_settings.php: moved to '/tmp/virus/menu_settings.php.001'
/home/rackwell/domains/rackwell.com/.htpasswd/system_m.php: {HEX}Malware.Expert.generic.malware.124.UNOFFICIAL FOUND
/home/rackwell/domains/rackwell.com/.htpasswd/system_m.php: moved to '/tmp/virus/system_m.php.001'
/home/rackwell/domains/rackwell.com/logs/Feb-2020.tar.gz.3: {HEX}Malware.Expert.malware.url.hastebin.com.0.UNOFFICIAL FOUND
/home/rackwell/domains/rackwell.com/logs/Feb-2020.tar.gz.3: moved to '/tmp/virus/Feb-2020.tar.gz.3'
/home/rackwell/domains/rackwell.com/stats/menu_settings.php: {HEX}Malware.Expert.generic.malware.118.UNOFFICIAL FOUND
/home/rackwell/domains/rackwell.com/stats/menu_settings.php: moved to '/tmp/virus/menu_settings.php.002'
/home/rackwell/domains/rackwell.com/stats/system_m.php: {HEX}Malware.Expert.generic.malware.124.UNOFFICIAL FOUND
/home/rackwell/domains/rackwell.com/stats/system_m.php: moved to '/tmp/virus/system_m.php.002'
/home/arcobaleno/imap/arcobaleno-cm.com/info/Maildir/new/1559605223.H864044P25281.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/arcobaleno/imap/arcobaleno-cm.com/info/Maildir/new/1559605223.H864044P25281.ns1.thaidreamhost.com: moved to '/tmp/virus/1559605223.H864044P25281.ns1.thaidreamhost.com'
/home/arcobaleno/imap/arcobaleno-cm.com/info/Maildir/new/1580825548.H331367P31837.ns1.thaidreamhost.com: Doc.Dropper.Agent-7577303-0 FOUND
/home/arcobaleno/imap/arcobaleno-cm.com/info/Maildir/new/1580825548.H331367P31837.ns1.thaidreamhost.com: moved to '/tmp/virus/1580825548.H331367P31837.ns1.thaidreamhost.com'
/home/kpatara/imap/kpatara.com/kpataralumber/Maildir/new/1580355228.H913817P14275.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/kpatara/imap/kpatara.com/kpataralumber/Maildir/new/1580355228.H913817P14275.ns1.thaidreamhost.com: moved to '/tmp/virus/1580355228.H913817P14275.ns1.thaidreamhost.com'
/home/kpatara/imap/kpatara.com/kpataralumber/Maildir/new/1579604528.H221652P30408.ns1.thaidreamhost.com: Win.Trojan.VBGeneric-7556888-0 FOUND
/home/kpatara/imap/kpatara.com/kpataralumber/Maildir/new/1579604528.H221652P30408.ns1.thaidreamhost.com: moved to '/tmp/virus/1579604528.H221652P30408.ns1.thaidreamhost.com'
/home/kpatara/imap/kpatara.com/kpataralumber/Maildir/new/1581316337.H984732P28113.ns1.thaidreamhost.com: Win.Malware.Generic-7583833-0 FOUND
/home/kpatara/imap/kpatara.com/kpataralumber/Maildir/new/1581316337.H984732P28113.ns1.thaidreamhost.com: moved to '/tmp/virus/1581316337.H984732P28113.ns1.thaidreamhost.com'
/home/kpatara/imap/kpatara.com/kpataralumber/Maildir/new/1580897814.H349300P12248.ns1.thaidreamhost.com: Win.Trojan.Vebzenpak-7581586-0 FOUND
/home/kpatara/imap/kpatara.com/kpataralumber/Maildir/new/1580897814.H349300P12248.ns1.thaidreamhost.com: moved to '/tmp/virus/1580897814.H349300P12248.ns1.thaidreamhost.com'
/home/kpatara/imap/kpatara.com/vuttipong/Maildir/new/1430321169.H939242P20198.ns165.thaidreamhost.com: Win.Dropper.Upatre-7524255-0 FOUND
/home/kpatara/imap/kpatara.com/vuttipong/Maildir/new/1430321169.H939242P20198.ns165.thaidreamhost.com: moved to '/tmp/virus/1430321169.H939242P20198.ns165.thaidreamhost.com'
/home/campthai/imap/campthai.com/sale/Maildir/new/1581303983.H908334P19670.ns1.thaidreamhost.com: Win.Malware.Generic-7583833-0 FOUND
/home/campthai/imap/campthai.com/sale/Maildir/new/1581303983.H908334P19670.ns1.thaidreamhost.com: moved to '/tmp/virus/1581303983.H908334P19670.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/sale/Maildir/new/1581381106.H218340P14559.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/campthai/imap/campthai.com/sale/Maildir/new/1581381106.H218340P14559.ns1.thaidreamhost.com: moved to '/tmp/virus/1581381106.H218340P14559.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/sale/Maildir/new/1568607191.H633690P10652.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/campthai/imap/campthai.com/sale/Maildir/new/1568607191.H633690P10652.ns1.thaidreamhost.com: moved to '/tmp/virus/1568607191.H633690P10652.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/sale/Maildir/new/1581390324.H104791P17653.ns1.thaidreamhost.com: Xls.Dropper.Agent-7585263-0 FOUND
/home/campthai/imap/campthai.com/sale/Maildir/new/1581390324.H104791P17653.ns1.thaidreamhost.com: moved to '/tmp/virus/1581390324.H104791P17653.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/sale/Maildir/new/1581385532.H520186P27724.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/campthai/imap/campthai.com/sale/Maildir/new/1581385532.H520186P27724.ns1.thaidreamhost.com: moved to '/tmp/virus/1581385532.H520186P27724.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/sale/Maildir/new/1580955089.H209497P15931.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/campthai/imap/campthai.com/sale/Maildir/new/1580955089.H209497P15931.ns1.thaidreamhost.com: moved to '/tmp/virus/1580955089.H209497P15931.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/info/Maildir/new/1580955089.H174090P15930.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/campthai/imap/campthai.com/info/Maildir/new/1580955089.H174090P15930.ns1.thaidreamhost.com: moved to '/tmp/virus/1580955089.H174090P15930.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/info/Maildir/new/1568588740.H516940P15548.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/campthai/imap/campthai.com/info/Maildir/new/1568588740.H516940P15548.ns1.thaidreamhost.com: moved to '/tmp/virus/1568588740.H516940P15548.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/info/Maildir/new/1581381838.H252162P16372.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/campthai/imap/campthai.com/info/Maildir/new/1581381838.H252162P16372.ns1.thaidreamhost.com: moved to '/tmp/virus/1581381838.H252162P16372.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/info/Maildir/new/1581385532.H494001P27723.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/campthai/imap/campthai.com/info/Maildir/new/1581385532.H494001P27723.ns1.thaidreamhost.com: moved to '/tmp/virus/1581385532.H494001P27723.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/info/Maildir/new/1581302416.H984816P12986.ns1.thaidreamhost.com: Win.Malware.Generic-7583833-0 FOUND
/home/campthai/imap/campthai.com/info/Maildir/new/1581302416.H984816P12986.ns1.thaidreamhost.com: moved to '/tmp/virus/1581302416.H984816P12986.ns1.thaidreamhost.com'
/home/campthai/imap/campthai.com/info/Maildir/new/1581390324.H78183P17652.ns1.thaidreamhost.com: Xls.Dropper.Agent-7585263-0 FOUND
/home/campthai/imap/campthai.com/info/Maildir/new/1581390324.H78183P17652.ns1.thaidreamhost.com: moved to '/tmp/virus/1581390324.H78183P17652.ns1.thaidreamhost.com'
/home/teradev/domains/teraconsultant.com/public_html/Card/.97b7f.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/Card/.97b7f.php: moved to '/tmp/virus/.97b7f.php'
/home/teradev/domains/teraconsultant.com/public_html/Card/.e4858.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/Card/.e4858.php: moved to '/tmp/virus/.e4858.php'
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/.26f7a.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/.26f7a.php: moved to '/tmp/virus/.26f7a.php'
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/plugins/bootstrap-datetimepicker/screenshot/daaa592.php: {HEX}Malware.Expert.generic.malware.44.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/plugins/bootstrap-datetimepicker/screenshot/daaa592.php: moved to '/tmp/virus/daaa592.php'
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/plugins/fancybox/lib/.094573: {HEX}Malware.Expert.generic.malware.124.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/plugins/fancybox/lib/.094573: moved to '/tmp/virus/.094573'
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/.15521c.jpg: {HEX}Malware.Expert.generic.malware.124.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/.15521c.jpg: moved to '/tmp/virus/.15521c.jpg'
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/scripts/.880c43: {HEX}Malware.Expert.generic.malware.124.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/scripts/.880c43: moved to '/tmp/virus/.880c43'
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/img/.3ac07f: {HEX}Malware.Expert.generic.malware.124.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/assets/img/.3ac07f: moved to '/tmp/virus/.3ac07f'
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/.c4daa.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/cu_intranet/.c4daa.php: moved to '/tmp/virus/.c4daa.php'
/home/teradev/domains/teraconsultant.com/public_html/wp-admin/options-style.php: {HEX}Malware.Expert.generic.base64.decode.1.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/wp-admin/options-style.php: moved to '/tmp/virus/options-style.php'
/home/teradev/domains/teraconsultant.com/public_html/wp-admin/.7529d.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/wp-admin/.7529d.php: moved to '/tmp/virus/.7529d.php'
/home/teradev/domains/teraconsultant.com/public_html/kml/.5063d.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/kml/.5063d.php: moved to '/tmp/virus/.5063d.php'
/home/teradev/domains/teraconsultant.com/public_html/kml/70de03pl.php: {HEX}Malware.Expert.malware.chr.hex.1.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/kml/70de03pl.php: moved to '/tmp/virus/70de03pl.php'
/home/teradev/domains/teraconsultant.com/public_html/wp-load.php: {HEX}Malware.Expert.generic.malware.179.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/wp-load.php: moved to '/tmp/virus/wp-load.php'
/home/teradev/domains/teraconsultant.com/public_html/assets/frontend/.a6f4c.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/assets/frontend/.a6f4c.php: moved to '/tmp/virus/.a6f4c.php'
/home/teradev/domains/teraconsultant.com/public_html/assets/frontend/.077c3.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/assets/frontend/.077c3.php: moved to '/tmp/virus/.077c3.php'
/home/teradev/domains/teraconsultant.com/public_html/assets/.45223.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/assets/.45223.php: moved to '/tmp/virus/.45223.php'
/home/teradev/domains/teraconsultant.com/public_html/assets/.9ff48.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/assets/.9ff48.php: moved to '/tmp/virus/.9ff48.php'
/home/teradev/domains/teraconsultant.com/public_html/assets/admin/layout/.2cf4d2: {HEX}Malware.Expert.generic.malware.124.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/assets/admin/layout/.2cf4d2: moved to '/tmp/virus/.2cf4d2'
/home/teradev/domains/teraconsultant.com/public_html/assets/admin/.b7ad0.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/assets/admin/.b7ad0.php: moved to '/tmp/virus/.b7ad0.php'
/home/teradev/domains/teraconsultant.com/public_html/assets/global/plugins/bootstrap-editable/bootstrap-editable/ee0282e.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/assets/global/plugins/bootstrap-editable/bootstrap-editable/ee0282e.php: moved to '/tmp/virus/ee0282e.php'
/home/teradev/domains/teraconsultant.com/public_html/gmail/.f3fbf.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/gmail/.f3fbf.php: moved to '/tmp/virus/.f3fbf.php'
/home/teradev/domains/teraconsultant.com/public_html/gmail/.1b8e9.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/gmail/.1b8e9.php: moved to '/tmp/virus/.1b8e9.php'
/home/teradev/domains/teraconsultant.com/public_html/mapcom/.1dfdf.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/mapcom/.1dfdf.php: moved to '/tmp/virus/.1dfdf.php'
/home/teradev/domains/teraconsultant.com/public_html/mapcom/.3b436.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/mapcom/.3b436.php: moved to '/tmp/virus/.3b436.php'
/home/teradev/domains/teraconsultant.com/public_html/mail/.e2861.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/mail/.e2861.php: moved to '/tmp/virus/.e2861.php'
/home/teradev/domains/teraconsultant.com/public_html/PHPWord/dir1/.4bbf8.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/PHPWord/dir1/.4bbf8.php: moved to '/tmp/virus/.4bbf8.php'
/home/teradev/domains/teraconsultant.com/public_html/PHPWord/PHPWord/.7bd97.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/PHPWord/PHPWord/.7bd97.php: moved to '/tmp/virus/.7bd97.php'
/home/teradev/domains/teraconsultant.com/public_html/yod/.269c9.php: {HEX}Malware.Expert.generic.uploader.40.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/yod/.269c9.php: moved to '/tmp/virus/.269c9.php'
/home/teradev/domains/teraconsultant.com/public_html/yod/.b4938.php: {HEX}Malware.Expert.generic.base64.decode.assert.0.UNOFFICIAL FOUND
/home/teradev/domains/teraconsultant.com/public_html/yod/.b4938.php: moved to '/tmp/virus/.b4938.php'
/home/thaidreamh/imap/vouchercarrent.com/sales/Maildir/new/1550719848.H788688P20418.vps933.vpshispeed.net: Win.Trojan.Autoit-7585910-0 FOUND
/home/thaidreamh/imap/vouchercarrent.com/sales/Maildir/new/1550719848.H788688P20418.vps933.vpshispeed.net: moved to '/tmp/virus/1550719848.H788688P20418.vps933.vpshispeed.net'
/home/thaidreamh/domains/vouchercarrent.com/public_html/redomain/model/admin.productsetting.php: {HEX}Malware.Expert.generic.eval.21.UNOFFICIAL FOUND
/home/thaidreamh/domains/vouchercarrent.com/public_html/redomain/model/admin.productsetting.php: moved to '/tmp/virus/admin.productsetting.php.001'
/home/thaidreamh/domains/vouchercarrent.com/public_html/redomain/template3_old_files.tgz: {HEX}Malware.Expert.generic.eval.21.UNOFFICIAL FOUND
/home/thaidreamh/domains/vouchercarrent.com/public_html/redomain/template3_old_files.tgz: moved to '/tmp/virus/template3_old_files.tgz.001'
/home/dkbook/domains/thaidk.com/logs/Feb-2020.tar.gz: {HEX}Malware.Expert.generic.eval.post.0.UNOFFICIAL FOUND
/home/dkbook/domains/thaidk.com/logs/Feb-2020.tar.gz: moved to '/tmp/virus/Feb-2020.tar.gz'
/home/dkbook/domains/thaidk.com/logs/Feb-2020.tar.gz.2: {HEX}Malware.Expert.generic.eval.post.0.UNOFFICIAL FOUND
/home/dkbook/domains/thaidk.com/logs/Feb-2020.tar.gz.2: moved to '/tmp/virus/Feb-2020.tar.gz.2'
/home/thaitourse/imap/thaitoursearch.com/sales/Maildir/new/1550719848.H823898P20419.vps933.vpshispeed.net: Win.Trojan.Autoit-7585910-0 FOUND
/home/thaitourse/imap/thaitoursearch.com/sales/Maildir/new/1550719848.H823898P20419.vps933.vpshispeed.net: moved to '/tmp/virus/1550719848.H823898P20419.vps933.vpshispeed.net'
/home/thaitourse/imap/thaitoursearch.com/sales/Maildir/new/1579252373.H327039P15321.ns1.thaidreamhost.com: Win.Trojan.Razy-7557047-0 FOUND
/home/thaitourse/imap/thaitoursearch.com/sales/Maildir/new/1579252373.H327039P15321.ns1.thaidreamhost.com: moved to '/tmp/virus/1579252373.H327039P15321.ns1.thaidreamhost.com'
/home/thaitourse/imap/thaitoursearch.com/sales/Maildir/new/1553729456.H923210P16722.ns1.thaidreamhost.com: Win.Trojan.Autoit-7585910-0 FOUND
/home/thaitourse/imap/thaitoursearch.com/sales/Maildir/new/1553729456.H923210P16722.ns1.thaidreamhost.com: moved to '/tmp/virus/1553729456.H923210P16722.ns1.thaidreamhost.com'
/home/thaitourse/domains/thaitoursearch.com/logs/Feb-2020.tar.gz: {HEX}Malware.Expert.generic.eval.post.0.UNOFFICIAL FOUND
/home/thaitourse/domains/thaitoursearch.com/logs/Feb-2020.tar.gz: moved to '/tmp/virus/Feb-2020.tar.gz.001'
/home/thaitourse/domains/thaitoursearch.com/logs/Feb-2020.tar.gz.2: {HEX}Malware.Expert.generic.eval.post.0.UNOFFICIAL FOUND
/home/thaitourse/domains/thaitoursearch.com/logs/Feb-2020.tar.gz.2: moved to '/tmp/virus/Feb-2020.tar.gz.2.001'
LibClamAV Warning: SWF: declared output length != inflated stream size, 149759 != 149763
LibClamAV Warning: SWF: declared output length != inflated stream size, 145931 != 145935
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2012-05-19_before_smf_patch_2.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2012-05-19_before_smf_patch_2.tar.gz: moved to '/tmp/virus/2012-05-19_before_smf_patch_2.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2019-03-14_before_smf_patch_2.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2019-03-14_before_smf_patch_2.tar.gz: moved to '/tmp/virus/2019-03-14_before_smf_patch_2.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2012-05-19_before_smf_patch_2_2.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2012-05-19_before_smf_patch_2_2.tar.gz: moved to '/tmp/virus/2012-05-19_before_smf_patch_2_2.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2015-09-28_before_Global-Headers-and-Footers-2.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2015-09-28_before_Global-Headers-and-Footers-2.tar.gz: moved to '/tmp/virus/2015-09-28_before_Global-Headers-and-Footers-2.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2014-12-26_before_smf_patch_1.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2014-12-26_before_smf_patch_1.tar.gz: moved to '/tmp/virus/2014-12-26_before_smf_patch_1.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2015-10-11_before_smf_patch_2.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2015-10-11_before_smf_patch_2.tar.gz: moved to '/tmp/virus/2015-10-11_before_smf_patch_2.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2015-09-27_before_smf_patch_2.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2015-09-27_before_smf_patch_2.tar.gz: moved to '/tmp/virus/2015-09-27_before_smf_patch_2.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2019-03-14_before_smf_patch_2_2.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2019-03-14_before_smf_patch_2_2.tar.gz: moved to '/tmp/virus/2019-03-14_before_smf_patch_2_2.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2014-07-02_before_mkress-smf_kitseositemap-2.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2014-07-02_before_mkress-smf_kitseositemap-2.tar.gz: moved to '/tmp/virus/2014-07-02_before_mkress-smf_kitseositemap-2.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2019-03-14_before_smf_patch_2_4.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2019-03-14_before_smf_patch_2_4.tar.gz: moved to '/tmp/virus/2019-03-14_before_smf_patch_2_4.tar.gz'
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2019-03-14_before_smf_patch_2_3.tar.gz: {HEX}Malware.Expert.generic.mailer.27.UNOFFICIAL FOUND
/home/civichf/domains/civicfanclub.com/public_html/Packages/backups/2019-03-14_before_smf_patch_2_3.tar.gz: moved to '/tmp/virus/2019-03-14_before_smf_patch_2_3.tar.gz'
/home/paymentcc/Maildir/lqb6avyh.php: {HEX}Malware.Expert.generic.malware.178.UNOFFICIAL FOUND
/home/paymentcc/Maildir/lqb6avyh.php: moved to '/tmp/virus/lqb6avyh.php'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581578752.H486904P6386.ns1.thaidreamhost.com:2,S: Win.Dropper.Noon-7586644-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581578752.H486904P6386.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581578752.H486904P6386.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581291564.H675098P12640.ns1.thaidreamhost.com:2,S: Pdf.Dropper.Agent-7585030-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581291564.H675098P12640.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581291564.H675098P12640.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1580863821.H699995P14125.ns1.thaidreamhost.com:2,S: Win.Trojan.Wacatac-7581847-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1580863821.H699995P14125.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1580863821.H699995P14125.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581585904.H62272P3129.ns1.thaidreamhost.com:2,S: Win.Dropper.Noon-7586644-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581585904.H62272P3129.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581585904.H62272P3129.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581687472.H740251P27783.ns1.thaidreamhost.com:2,S: Win.Malware.Generic-7586959-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581687472.H740251P27783.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581687472.H740251P27783.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581078482.H772991P14474.ns1.thaidreamhost.com:2,S: Win.Trojan.Generic-7580179-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581078482.H772991P14474.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581078482.H772991P14474.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581679126.H460404P31295.ns1.thaidreamhost.com:2,S: Win.Malware.Generic-7586959-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581679126.H460404P31295.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581679126.H460404P31295.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1580897887.H212007P12368.ns1.thaidreamhost.com:2,S: Win.Trojan.VBGeneric-7580607-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1580897887.H212007P12368.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1580897887.H212007P12368.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1580860984.H329071P8214.ns1.thaidreamhost.com:2,S: Win.Trojan.Wacatac-7581847-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1580860984.H329071P8214.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1580860984.H329071P8214.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1580897494.H179514P10959.ns1.thaidreamhost.com:2,S: Win.Trojan.Vebzenpak-7581586-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1580897494.H179514P10959.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1580897494.H179514P10959.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581588615.H60303P14803.ns1.thaidreamhost.com:2,S: Win.Dropper.Noon-7586644-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581588615.H60303P14803.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581588615.H60303P14803.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581235333.H220464P31199.ns1.thaidreamhost.com:2,S: Pdf.Dropper.Agent-7584921-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581235333.H220464P31199.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581235333.H220464P31199.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581334270.H669388P26245.ns1.thaidreamhost.com:2,S: Win.Dropper.LokiBot-7584438-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581334270.H669388P26245.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581334270.H669388P26245.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581614973.H802324P23642.ns1.thaidreamhost.com:2,S: Win.Dropper.Noon-7586644-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581614973.H802324P23642.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581614973.H802324P23642.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581317075.H115636P30119.ns1.thaidreamhost.com:2,S: Win.Malware.Generic-7583833-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581317075.H115636P30119.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581317075.H115636P30119.ns1.thaidreamhost.com:2,S'
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581467297.H616828P10150.ns1.thaidreamhost.com:2,S: Xls.Dropper.Agent-7586409-0 FOUND
/home/ssctannery/imap/ssctannery.com/kamchai/Maildir/cur/1581467297.H616828P10150.ns1.thaidreamhost.com:2,S: moved to '/tmp/virus/1581467297.H616828P10150.ns1.thaidreamhost.com:2,S'

----------- SCAN SUMMARY -----------
Known viruses: 6757343
Engine version: 0.101.2
Scanned directories: 25864
Scanned files: 412667
Infected files: 133
Data scanned: 27516.73 MB
Data read: 16391.67 MB (ratio 1.68:1)
Time: 9270.678 sec (154 m 30 s)
100
เรื่องส่วนตัว เก็บไว้อ่านเอง / ติดตั้ง ClamAV ใน Directadmin และเพิ่ม rule พิเศษสำหรับค้าหา PHP Backdoor
« Last post by Ralphbut on February 15, 2020, 08:47:40 AM »
ClamAV เป็น Software ป้องกันไวรัสที่ได้รับความนิยมสูงในผู้ใช้งาน Linux และในเนื้อหาวันนี้จะแนะนำการ Install ใน Directadmin และเพิ่ม rule พิเศษสำหรับการค้นหา  PHP Backdoor / Malware

 

ติดตั้ง ClamAV บน Directadmin

cd /usr/local/directadmin/custombuild
./build update
./build set clamav yes
./build clamav
เพิ่ม Rules จาก rfxn สำหรับค้นหา PHP Shell / Backdoor โดยแก้ไขไฟล์  /etc/freshclam.conf  และเพิ่มคำสั่งด้านล่างเข้าไป

DatabaseCustomURL http://www.rfxn.com/downloads/rfxn.ndb
DatabaseCustomURL http://www.rfxn.com/downloads/rfxn.hdb
 

สั่ง Update rule

freshclam
 

ทดสอบ Scan Virus/Malware

 clamscan -ri --move=/tmp/virus /home
ความหมายคือให้ scan Virus ทุกไฟล์ใน /home โดยถ้าเจอจะนำไปเก็บไว้ที่ /tmp/virus

 



 

ผมได้ทดสอบนำ malware / backdoor ต่างๆมาทดสอบแล้วได้ผลและค้าหาเจอมากกว่า 90%  และเจอในส่วนของ false positive บ้าง ในบทความต่อๆไปจะม่พูดเรื่องการ custom rule ของ ClamAV เพื่อลด false positive อีกครั้ง

 

แหล่งที่มา : https://d.thaihosttalk.com/t/clamav-anti-malwere-php/40398
Pages: 1 ... 8 9 [10]