Thursday, April 26, 2012 11:54 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.32.183.177 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-115312-T5lvaEgJ6KoAAG5@5UYAAAAr-file-W0pZkm.1335455592_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-115312-T5lvaEgJ6KoAAG5@5UYAAAAr-file-W0pZkm) # Regular expression match = [decode regex: 1]: '/tmp/20120426-115312-T5lvaEgJ6KoAAG5@5UYAAAAr-file-W0pZkm' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-115312-T5lvaEgJ6KoAAG5@5UYAAAAr-file-W0pZkm' Thursday, April 26, 2012 11:53 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.32.183.177 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-115325-T5lvdUgJ6KoAAFDkuuoAAAAM-file-nO8WCu.1335455606_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-115325-T5lvdUgJ6KoAAFDkuuoAAAAM-file-nO8WCu) # Regular expression match = [decode regex: 1]: '/tmp/20120426-115325-T5lvdUgJ6KoAAFDkuuoAAAAM-file-nO8WCu' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-115325-T5lvdUgJ6KoAAFDkuuoAAAAM-file-nO8WCu' Thursday, April 26, 2012 11:53 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.32.183.177 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-115318-T5lvbkgJ6KoAAC8mH5sAAAAZ-file-FiSRcn.1335455599_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-115318-T5lvbkgJ6KoAAC8mH5sAAAAZ-file-FiSRcn) # Regular expression match = [decode regex: 1]: '/tmp/20120426-115318-T5lvbkgJ6KoAAC8mH5sAAAAZ-file-FiSRcn' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-115318-T5lvbkgJ6KoAAC8mH5sAAAAZ-file-FiSRcn' Thursday, April 26, 2012 11:46 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.12.109.103 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-114514-T5ltikgJ6KoAACYfNRcAAAA9-file-XFKs9d.1335455114_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-114514-T5ltikgJ6KoAACYfNRcAAAA9-file-XFKs9d) # Regular expression match = [decode regex: 1]: '/tmp/20120426-114514-T5ltikgJ6KoAACYfNRcAAAA9-file-XFKs9d' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-114514-T5ltikgJ6KoAACYfNRcAAAA9-file-XFKs9d' Thursday, April 26, 2012 11:45 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.12.109.103 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-114507-T5ltg0gJ6KoAAAV@-s4AAAA6-file-xqfNKL.1335455107_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-114507-T5ltg0gJ6KoAAAV@-s4AAAA6-file-xqfNKL) # Regular expression match = [decode regex: 1]: '/tmp/20120426-114507-T5ltg0gJ6KoAAAV@-s4AAAA6-file-xqfNKL' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-114507-T5ltg0gJ6KoAAAV@-s4AAAA6-file-xqfNKL' Thursday, April 26, 2012 11:45 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.12.109.103 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-114500-T5lte0gJ6KoAACPyEvcAAAAO-file-HzP9Mg.1335455100_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-114500-T5lte0gJ6KoAACPyEvcAAAAO-file-HzP9Mg) # Regular expression match = [decode regex: 1]: '/tmp/20120426-114500-T5lte0gJ6KoAACPyEvcAAAAO-file-HzP9Mg' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-114500-T5lte0gJ6KoAACPyEvcAAAAO-file-HzP9Mg' Thursday, April 26, 2012 11:43 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 200.158.198.8 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-114252-T5ls-EgJ6KoAAH0Pq@gAAAA4-file-Q6G781.1335454973_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-114252-T5ls-EgJ6KoAAH0Pq@gAAAA4-file-Q6G781) # Regular expression match = [decode regex: 1]: '/tmp/20120426-114252-T5ls-EgJ6KoAAH0Pq@gAAAA4-file-Q6G781' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-114252-T5ls-EgJ6KoAAH0Pq@gAAAA4-file-Q6G781' Thursday, April 26, 2012 11:43 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 200.158.198.8 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-114245-T5ls9UgJ6KoAAH9vxpYAAAAK-file-E0ndr9.1335454965_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-114245-T5ls9UgJ6KoAAH9vxpYAAAAK-file-E0ndr9) # Regular expression match = [decode regex: 1]: '/tmp/20120426-114245-T5ls9UgJ6KoAAH9vxpYAAAAK-file-E0ndr9' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-114245-T5ls9UgJ6KoAAH9vxpYAAAAK-file-E0ndr9' Thursday, April 26, 2012 11:42 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 200.158.198.8 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-114234-T5ls6kgJ6KoAAH7rv8YAAAAU-file-cvEnO1.1335454955_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-114234-T5ls6kgJ6KoAAH7rv8YAAAAU-file-cvEnO1) # Regular expression match = [decode regex: 1]: '/tmp/20120426-114234-T5ls6kgJ6KoAAH7rv8YAAAAU-file-cvEnO1' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-114234-T5ls6kgJ6KoAAH7rv8YAAAAU-file-cvEnO1' Thursday, April 26, 2012 11:35 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.6.20.92 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-113534-T5lrRkgJ6KoAAEIhrEEAAAAm-file-n5DxCx.1335454534_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-113534-T5lrRkgJ6KoAAEIhrEEAAAAm-file-n5DxCx) # Regular expression match = [decode regex: 1]: '/tmp/20120426-113534-T5lrRkgJ6KoAAEIhrEEAAAAm-file-n5DxCx' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-113534-T5lrRkgJ6KoAAEIhrEEAAAAm-file-n5DxCx' Thursday, April 26, 2012 11:35 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.6.20.92 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-113526-T5lrPkgJ6KoAAEEjnRAAAAAf-file-lDRjA7.1335454527_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-113526-T5lrPkgJ6KoAAEEjnRAAAAAf-file-lDRjA7) # Regular expression match = [decode regex: 1]: '/tmp/20120426-113526-T5lrPkgJ6KoAAEEjnRAAAAAf-file-lDRjA7' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-113526-T5lrPkgJ6KoAAEEjnRAAAAAf-file-lDRjA7' Thursday, April 26, 2012 11:35 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 189.6.20.92 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-113520-T5lrN0gJ6KoAABzWhLAAAABJ-file-c7omNO.1335454520_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-113520-T5lrN0gJ6KoAABzWhLAAAABJ-file-c7omNO) # Regular expression match = [decode regex: 1]: '/tmp/20120426-113520-T5lrN0gJ6KoAABzWhLAAAABJ-file-c7omNO' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-113520-T5lrN0gJ6KoAABzWhLAAAABJ-file-c7omNO' Thursday, April 26, 2012 11:33 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 186.225.128.110 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-113258-T5lqqkgJ6KoAAELIs68AAAAr-file-y1lH6E.1335454379_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-113258-T5lqqkgJ6KoAAELIs68AAAAr-file-y1lH6E) # Regular expression match = [decode regex: 1]: '/tmp/20120426-113258-T5lqqkgJ6KoAAELIs68AAAAr-file-y1lH6E' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-113258-T5lqqkgJ6KoAAELIs68AAAAr-file-y1lH6E' Thursday, April 26, 2012 11:33 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 186.225.128.110 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-113305-T5lqsUgJ6KoAABvCdjQAAAAH-file-tyZ7sV.1335454386_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-113305-T5lqsUgJ6KoAABvCdjQAAAAH-file-tyZ7sV) # Regular expression match = [decode regex: 1]: '/tmp/20120426-113305-T5lqsUgJ6KoAABvCdjQAAAAH-file-tyZ7sV' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-113305-T5lqsUgJ6KoAABvCdjQAAAAH-file-tyZ7sV' Thursday, April 26, 2012 11:33 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 186.225.128.110 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-113251-T5lqo0gJ6KoAAEH8qNEAAAAi-file-qtghY8.1335454371_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-113251-T5lqo0gJ6KoAAEH8qNEAAAAi-file-qtghY8) # Regular expression match = [decode regex: 1]: '/tmp/20120426-113251-T5lqo0gJ6KoAAEH8qNEAAAAi-file-qtghY8' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-113251-T5lqo0gJ6KoAAEH8qNEAAAAi-file-qtghY8' Thursday, April 26, 2012 11:32 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 187.0.5.210 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-113150-T5lqZkgJ6KoAACUSeK4AAAAA-file-brBjPS.1335454311_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-113150-T5lqZkgJ6KoAACUSeK4AAAAA-file-brBjPS) # Regular expression match = [decode regex: 1]: '/tmp/20120426-113150-T5lqZkgJ6KoAACUSeK4AAAAA-file-brBjPS' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-113150-T5lqZkgJ6KoAACUSeK4AAAAA-file-brBjPS' Thursday, April 26, 2012 11:31 AM Scanning web upload script file... Web upload script user: nobody (99) Web upload script owner: () Web upload script: /home/themattr/public_html/mattress-forum Remote IP: 187.0.5.210 Deleted: No Quarantined: Yes [/home/quarantine/nobody/20120426-113140-T5lqXEgJ6KoAABzRg6YAAABE-file-90sZzS.1335454300_1] NOTE: This alert may be a ModSecurity false-positive as /home/themattr/public_html/mattress-forum does not exist ----------- SCAN REPORT ----------- (/usr/sbin/cxs --smtp --options mMOLfSGchexdnwZDR --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 500000 --summary --quarantine /home/quarantine --mail root --quiet --timemax 30 --qoptions Mv --cgi --virusscan --clamdsock /var/clamd --exploitscan /tmp//20120426-113140-T5lqXEgJ6KoAABzRg6YAAABE-file-90sZzS) # Regular expression match = [decode regex: 1]: '/tmp/20120426-113140-T5lqXEgJ6KoAABzRg6YAAABE-file-90sZzS' # (decoded file [depth: 1]) Known exploit = [Fingerprint Match] [PHP REQUEST Exploit [P0007]]: '/tmp/20120426-113140-T5lqXEgJ6KoAABzRg6YAAABE-file-90sZzS'