Gecko [ www.pepper-staffing.co.uk ]

Name	Size	Permission	Date
.app_backup	[ DIR ]	drwxr-xr-x	2025-02-11 15:28
.cagefs	[ DIR ]	drwxrwx--x	2024-02-01 14:51
.caldav	[ DIR ]	drwxr-xr-x	2026-06-17 14:35
.cl.selector	[ DIR ]	drwxr-xr-x	2026-06-17 10:31
.clwpos	[ DIR ]	drwxr-xr-x	2021-11-06 06:34
.cpanel	[ DIR ]	drwx------	2026-06-18 03:50
.cphorde	[ DIR ]	drwxr-xr-x	2024-03-30 19:21
.htpasswds	[ DIR ]	drwxr-x---	2026-06-11 10:28
.nc_plugin	[ DIR ]	drwx--x--x	2024-02-01 14:42
.pki	[ DIR ]	drwxr-xr-x	2019-12-23 13:25
.razor	[ DIR ]	drwxr-xr-x	2023-03-15 12:02
.softaculous	[ DIR ]	drwx--x--x	2024-06-28 23:34
.spamassassin	[ DIR ]	drwxr-xr-x	2021-02-12 17:34
.subaccounts	[ DIR ]	drwxr-xr-x	2020-07-24 00:44
.trash	[ DIR ]	drwxr-xr-x	2026-06-13 00:44
.wp-cli	[ DIR ]	drwxr-xr-x	2020-07-17 19:58
465nafh.com.ng	[ DIR ]	drwxr-x---	2026-06-13 00:37
Enefoze.com	[ DIR ]	drwxr-x---	2026-06-14 04:02
TELSTATECH.COM	[ DIR ]	drwxr-x---	2026-06-13 00:31
abidencare.co.uk	[ DIR ]	drwxr-x---	2026-06-13 00:37
access-logs	[ DIR ]	drwxr-x---	2026-06-17 12:09
acehealth-caresolution.com	[ DIR ]	drwxr-x---	2026-06-13 00:37
alphanursinghome.com.ng	[ DIR ]	drwxr-x---	2026-06-13 00:50
arawares.com.ng	[ DIR ]	drwxr-x---	2026-06-13 00:53
azuahealthcare.ng	[ DIR ]	drwxr-x---	2026-06-13 00:38
beerific.ng	[ DIR ]	drwxr-x---	2026-06-14 04:02
bespoke.ng	[ DIR ]	drwxr-x---	2026-06-14 04:02
bio-carelabs.com	[ DIR ]	drwxr-xr-x	2026-06-13 00:38
cache	[ DIR ]	drwxr-xr-x	2026-06-13 00:37
cssakwaibom.com.ng	[ DIR ]	drwxr-x---	2026-06-13 00:36
dantatafarms.com.ng	[ DIR ]	drwxr-x---	2026-06-14 04:02
divine-diagnosis.com	[ DIR ]	drwxr-x---	2026-06-13 00:39
enhancehealthscotland.com	[ DIR ]	drwxr-x---	2026-06-13 00:36
etc	[ DIR ]	drwxr-x---	2026-06-17 14:35
ezetogs.com.ng	[ DIR ]	drwxr-x---	2026-06-14 04:02
firstchoiceagency.uk	[ DIR ]	drwxr-x---	2026-06-17 14:33
ghpropertiesaffair.com	[ DIR ]	drwxr-x---	2026-06-14 04:02
ghpropertiesaffair.com.ng	[ DIR ]	drwxr-x---	2026-06-14 04:02
graceful-heritagecare.com	[ DIR ]	drwxr-x---	2026-06-13 00:48
helpdesk.hyperdistribution.com.ng	[ DIR ]	drwxr-x---	2026-06-14 04:02
logs	[ DIR ]	drwxr-xr-x	2026-06-17 12:40
lscache	[ DIR ]	drwxrws---	2026-05-20 08:34
mail	[ DIR ]	drwxr-x--x	2026-06-17 14:35
manorhealthcare.org.uk	[ DIR ]	drwxr-x---	2026-06-17 15:40
marketeering.ng	[ DIR ]	drwxr-x---	2026-06-13 00:49
masccarehome.com.ng	[ DIR ]	drwxr-x---	2026-06-13 00:49
pejehealthcare.co.uk	[ DIR ]	drwxr-x---	2026-06-13 00:49
pepper-staffing.co.uk	[ DIR ]	drwxr-x---	2026-06-18 02:26
perl5	[ DIR ]	drwxr-xr-x	2026-05-20 08:34
prestigediagnostica.com	[ DIR ]	drwxr-x---	2026-06-13 00:49
public_ftp	[ DIR ]	drwxr-xr-x	2026-05-20 08:34
public_html	[ DIR ]	drwxr-x---	2026-06-18 01:35
pulchritudebynana.com	[ DIR ]	drwxr-x---	2026-06-14 04:02
reginamundihomes.ng	[ DIR ]	drwxr-x---	2026-06-13 00:35
seven-resourcingnursing.com	[ DIR ]	drwxr-x---	2026-06-18 01:35
softaculous_backups	[ DIR ]	drwx--x--x	2026-06-12 10:51
ssl	[ DIR ]	drwxr-xr-x	2026-06-17 15:42
telewanathan.com	[ DIR ]	drwxr-x---	2026-06-13 00:28
telstatech.com.ng	[ DIR ]	drwxr-x---	2026-06-17 15:29
tmp	[ DIR ]	drwxr-xr-x	2026-06-17 17:05
tohluwany.com	[ DIR ]	drwxr-x---	2026-06-13 00:32
unthlabs.com	[ DIR ]	drwxr-xr-x	2026-06-13 00:32
urbansignaturehomes.com	[ DIR ]	drwxr-x---	2026-06-18 01:35
wellcarehomes.com.ng	[ DIR ]	drwxr-x---	2026-06-13 00:51
www	[ DIR ]	drwxr-x---	2026-06-18 01:35
xactsdiagnosticservices.com.ng	[ DIR ]	drwxr-x---	2026-06-13 00:33
yumenterprise.com	[ DIR ]	drwxr-x---	2026-06-13 00:33
ziccarddsspecialistclinic.com.ng	[ DIR ]	drwxr-x---	2026-06-13 00:52
.bash_history	1.14 KB	-rw-r--r--	2026-06-13 02:30
.bash_logout	18 B	-rw-r--r--	2019-12-23 13:21
.bash_profile	193 B	-rw-r--r--	2019-12-23 13:21
.bashrc	231 B	-rw-r--r--	2019-12-23 13:21
.clamavconnector.disinfection.log	74 B	-rw-r--r--	2026-06-13 00:55
.clamavconnector.status	199 B	-rw-r--r--	2026-06-13 01:56
.contactemail	22 B	-rw-r--r--	2019-12-23 13:21
.dns	24 B	-rw-r--r--	2023-12-18 10:30
.gemrc	139 B	-rw-r--r--	2020-07-24 00:43
.htaccess	197 B	-rw-r--r--	2026-06-12 07:42
.imunify_patch_id	106 B	-rw-r--r--	2025-04-16 10:44
.last.inodes	18.74 KB	-rw-r--r--	2026-06-17 10:15
.lastlogin	583 B	-rw-r--r--	2026-06-17 16:49
.myimunify_id	102 B	-rw-r--r--	2024-03-24 09:54
.spamassassinboxenable	0 B	-rw-r--r--	2019-12-23 13:21
.spamassassinenable	0 B	-rw-r--r--	2019-12-23 13:21
.zshrc	658 B	-rw-r--r--	2020-07-24 00:43
scan__report.txt	5.68 KB	-rw-r--r--	2020-07-24 01:04
scanreport-hyperdis-Jun_09_2026_09h48m.txt	23.23 KB	-rw-r--r--	2026-06-09 15:49
scanreport-hyperdis-Jun_17_2026_11h40m.txt	7.38 KB	-rw-r--r--	2026-06-17 16:48

Rename

----------- SCAN REPORT -----------
TimeStamp: Wed, 17 Jun 2026 11:40:42 -0400
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 10000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/hyperdis/scanreport-hyperdis-Jun_17_2026_11h40m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user hyperdis --virusscan --vmrssmax 2000000 --waitscan 0 --xtra /etc/cxs/cxs.xtra.manual)

Scanning /home/hyperdis:

'/home/hyperdis/access-logs'
# Symlink to [/etc/apache2/logs/domlogs/hyperdis]

'/home/hyperdis/.cpanel/live-engine-connector-vP3eYFoShu.sock'
# Socket

'/home/hyperdis/.nc_plugin/hidden'
# World writeable directory
# Scan Timeout (30 secs) while processing:
'/home/hyperdis/pepper-staffing.co.uk/wp-content/themes/twentytwenty/inc/wp/oQypbaDQQ.php'

'/home/hyperdis/pepper-staffing.co.uk/wp-content/themes/twentytwenty/wp/ARHFJa.php'
# ClamAV detected virus = [TO-35550.WEBSHEL.nc_21_fCZfodQzer_notags_php.MD5-68eb58311c1ebd1acef987c4c8b6dc91.size-13796.UNOFFICIAL]

'/home/hyperdis/pepper-staffing.co.uk/wp-includes/images/crystal/wp/xHHucEf.php'
# Universal decode regex match = [universal decoder]

'/home/hyperdis/public_html/wp-content/plugins/akismet/akismet.php'
# Script version check [OLD] [Akismet Anti-Spam v4.2.4 < v5.3.7]

'/home/hyperdis/public_html/wp-content/plugins/classic-editor/classic-editor.php'
# Script version check [OLD] [Classic Editor v1.6.2 < v1.6.7]

'/home/hyperdis/public_html/wp-content/plugins/contact-form-7/wp-contact-form-7.php'
# Script version check [OLD] [Contact Form 7 v5.5.6.1 < v6.0.6]

'/home/hyperdis/public_html/wp-content/plugins/elementor/elementor.php'
# Script version check [OLD] [Elementor v3.6.5 < v3.28.4]

'/home/hyperdis/public_html/wp-content/plugins/mega-elements-addons-for-elementor/includes/meafe-helpers.php'
# Universal decode regex match = [universal decoder]

'/home/hyperdis/public_html/wp-content/plugins/really-simple-ssl/rlrsssl-really-simple-ssl.php'
# Script version check [OLD] [Really Simple SSL v5.3.2 < v9.3.3]

'/home/hyperdis/public_html/wp-content/plugins/wpforms-lite/wpforms.php'
# Script version check [OLD] [WPForms Lite v1.7.4.2 < v1.9.4.2]
# Scan Timeout (30 secs) while processing:
'/home/hyperdis/public_html/wp-content/plugins/wpforms-lite/assets/css/builder/builder-fields-types.css'
# Scan Timeout (30 secs) while processing:
'/home/hyperdis/public_html/wp-content/plugins/wpforms-lite/assets/css/integrations/divi/wpforms-base.css'

'/home/hyperdis/public_html/wp-includes/version.php'
# Script version check [OLD] [Wordpress v6.0 < v6.8.2]

'/home/hyperdis/seven-resourcingnursing.com/index.php'
# Universal decode regex match = [universal decoder]

'/home/hyperdis/seven-resourcingnursing.com/wper.php'
# Universal decode regex match = [universal decoder]

'/home/hyperdis/seven-resourcingnursing.com/wp-admin/images/media-button-music-2x.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/hyperdis/seven-resourcingnursing.com/wp-content/php-compat/wp/wp/KMPMCuFaiR.php'
# ClamAV detected virus = [TO-35550.WEBSHEL.nc_21_fCZfodQzer_notags_php.MD5-68eb58311c1ebd1acef987c4c8b6dc91.size-13796.UNOFFICIAL]

'/home/hyperdis/seven-resourcingnursing.com/wp-content/themes/twentytwenty/inc/wp/wp/ZUxcv.php'
# Universal decode regex match = [universal decoder]

'/home/hyperdis/seven-resourcingnursing.com/wp-includes/revisson.php'
# Universal decode regex match = [universal decoder]

'/home/hyperdis/seven-resourcingnursing.com/wp-includes/block/blocks/SimplePie/blocks/php-compat/css/index.php'
# Known exploit = [Fingerprint Match (fp)] [Hacker Sig Exploit [P2246]]

'/home/hyperdis/seven-resourcingnursing.com/wp-includes/images/smilies/icon_twisteds.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/hyperdis/seven-resourcingnursing.com/wp-includes/images/style-engine/ID3/php-compat/network/wp/wp/OigWKYOJT.php'
# Universal decode regex match = [universal decoder]

'/home/hyperdis/seven-resourcingnursing.com/wp-includes/js/dist/server-sied-renders.min.js'
# Universal decode regex match = [universal decoder]

'/home/hyperdis/urbansignaturehomes.com/wp-content/ewww/cwebp'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/ewww/gifsicle'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/ewww/jpegtran'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/ewww/optipng'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/ewww/pngquant'
# Linux Binary/Executable [application/x-sharedlib]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/cwebp-fbsd'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/cwebp-linux'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/cwebp.exe'
# MS Windows Binary/Executable [application/x-winexec]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle-fbsd'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle-linux'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle.exe'
# MS Windows Binary/Executable [application/x-winexec]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran-fbsd'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran-linux'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/jpegtran.exe'
# MS Windows Binary/Executable [application/x-winexec]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/optipng-fbsd'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/optipng-linux'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/optipng.exe'
# MS Windows Binary/Executable [application/x-winexec]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/pngquant-fbsd'
# Linux Binary/Executable [application/x-executable]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/pngquant-linux'
# Linux Binary/Executable [application/x-sharedlib]

'/home/hyperdis/urbansignaturehomes.com/wp-content/plugins/ewww-image-optimizer/binaries/pngquant.exe'
# MS Windows Binary/Executable [application/x-winexec]

----------- SCAN SUMMARY -----------
Scanned directories: 12455
Scanned files: 65490
Ignored items: 820
Suspicious matches: 45
Viruses found: 2
Fingerprint matches: 1
Data scanned: 2208.20 MB
Scan peak memory: 371888 kB
Scan time/item: 0.052 sec
Scan time: 4072.791 sec