Spam boomerang

----------- SCAN REPORT -----------
TimeStamp: Mon, 5 Jun 2017 10:55:23 -0400
(/usr/sbin/cxs --nobayes --clamdsock /var/clamd --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 10000 --noforce --html --options mMOLfSGchexdnwZRrD --qoptions Mv --quarantine /cuarentena --sizemax 500000 --ssl --summary --sversionscan --timemax 30 --nounofficial --user boomerang --virusscan --web)


Scanning /home/boomerang:

'/home/boomerang/access-logs'
# Symlink to [/etc/apache2/logs/domlogs/boomerang]

'/home/boomerang/.cagefs/opt/alt/php44/link/conf'
# Symlink to [/opt/alt/php44/etc/php.d]

'/home/boomerang/.cagefs/opt/alt/php51/link/conf'
# Symlink to [/opt/alt/php51/etc/php.d]

'/home/boomerang/.cagefs/opt/alt/php52/link/conf'
# Symlink to [/opt/alt/php52/etc/php.d]

'/home/boomerang/.cagefs/opt/alt/php53/link/conf'
# Symlink to [/opt/alt/php53/etc/php.d]

'/home/boomerang/.cagefs/opt/alt/php54/link/conf'
# Symlink to [/opt/alt/php54/etc/php.d]

'/home/boomerang/.cagefs/opt/alt/php55/link/conf'
# Symlink to [/opt/alt/php55/etc/php.d]

'/home/boomerang/.cagefs/opt/alt/php56/link/conf'
# Symlink to [/opt/alt/php56/etc/php.d]

'/home/boomerang/.cagefs/opt/alt/php70/link/conf'
# Symlink to [/opt/alt/php70/etc/php.d]

'/home/boomerang/.cagefs/opt/alt/php71/link/conf'
# Symlink to [/opt/alt/php71/etc/php.d]

'/home/boomerang/.cagefs/tmp/.s.PGSQL.5432'
# Symlink to [/var/run/postgres/.s.PGSQL.5432]

'/home/boomerang/.cagefs/tmp/mysql.sock'
# Symlink to [/var/lib/mysql/mysql.sock]

'/home/boomerang/.cagefs/tmp/oWfEzUhK'
# (quarantined to /cuarentena/cxsuser/boomerang/oWfEzUhK.1496674524_1) ClamAV detected virus = [Unix.Malware.Agent-1401041]

'/home/boomerang/.cagefs/var/cache'
# World writeable directory

'/home/boomerang/.cagefs/var/cache/php-eaccelerator'
# World writeable directory

'/home/boomerang/.cagefs/var/php'
# World writeable directory

'/home/boomerang/.cagefs/var/php/apm'
# World writeable directory

'/home/boomerang/.cagefs/var/php/apm/db'
# World writeable directory

'/home/boomerang/.cagefs/var/run'
# World writeable directory

'/home/boomerang/.cagefs/var/run/screen'
# World writeable directory

'/home/boomerang/public_html/administrator/components/com_joomlaupdate/restore.php'
# Regular expression match = [symlink\s*\(]

'/home/boomerang/public_html/administrator/components/com_phocagallery/phocagallery.xml'
# Script version check [OLD] [Joomla Phoca Gallery Ext v4.2.2 < v4.3.0]

'/home/boomerang/public_html/administrator/components/com_redirect/models/forms/6S19HY.php'
# Decode regex match = [decode regex: 12]
# (decoded file [depth: 0]) Decode regex match = [decode regex: 12]

'/home/boomerang/public_html/anfitriones/administrator/cache'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/components'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/components/com_joomlaupdate/restore.php'
# Regular expression match = [symlink\s*\(]

'/home/boomerang/public_html/anfitriones/administrator/language'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/language/en-GB'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/language/overrides'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/logs'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/manifests/files'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/manifests/libraries'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/manifests/packages'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/modules'
# World writeable directory

'/home/boomerang/public_html/anfitriones/administrator/templates'
# World writeable directory

'/home/boomerang/public_html/anfitriones/cache'
# World writeable directory

'/home/boomerang/public_html/anfitriones/components'
# World writeable directory

'/home/boomerang/public_html/anfitriones/images'
# World writeable directory

'/home/boomerang/public_html/anfitriones/images/banners'
# World writeable directory

'/home/boomerang/public_html/anfitriones/images/headers'
# World writeable directory

'/home/boomerang/public_html/anfitriones/images/sampledata'
# World writeable directory

'/home/boomerang/public_html/anfitriones/language'
# World writeable directory

'/home/boomerang/public_html/anfitriones/language/en-GB'
# World writeable directory

'/home/boomerang/public_html/anfitriones/language/overrides'
# World writeable directory

'/home/boomerang/public_html/anfitriones/libraries'
# World writeable directory

'/home/boomerang/public_html/anfitriones/libraries/nextend2/smartslider/smartslider/libraries/storage.php'
# Universal decode regex match = [universal decoder]

'/home/boomerang/public_html/anfitriones/media'
# World writeable directory

'/home/boomerang/public_html/anfitriones/media/media/js/silverlightmediaelement.xap'
# (compressed file: SilverlightMediaElement.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec]

'/home/boomerang/public_html/anfitriones/modules'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/authentication'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/captcha'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/content'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/editors'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/editors-xtd'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/extension'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/fields'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/finder'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/installer'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/quickicon'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/search'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/system'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/twofactorauth'
# World writeable directory

'/home/boomerang/public_html/anfitriones/plugins/user'
# World writeable directory

'/home/boomerang/public_html/anfitriones/templates'
# World writeable directory

'/home/boomerang/public_html/anfitriones/tmp'
# World writeable directory

'/home/boomerang/public_html/components/com_contact/controllers/randy.php'
# (quarantined to /cuarentena/cxsuser/boomerang/randy.php.1496674678_1) Known exploit = [Fingerprint Match] [PHP Exploit]

'/home/boomerang/public_html/components/com_jce/editor/libraries/plupload/plupload.silverlight.xap'
# (compressed file: plupload.silverlight.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec]

'/home/boomerang/public_html/components/com_phocagallery/assets/plupload/plupload.silverlight.xap'
# (compressed file: plupload.silverlight.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec]

'/home/boomerang/public_html/images/bouncer'
# (quarantined to /cuarentena/cxsuser/boomerang/bouncer.1496674692_1) ClamAV detected virus = [Unix.Malware.Agent-1434809]

'/home/boomerang/public_html/images/cache_log.php'
# (quarantined to /cuarentena/cxsuser/boomerang/cache_log.php.1496674692_1) Known exploit = [Fingerprint Match] [PHP Obfuscation Exploit [P0877]]

'/home/boomerang/public_html/images/imagick.php'
# (quarantined to /cuarentena/cxsuser/boomerang/imagick.php.1496674692_1) Known exploit = [Fingerprint Match] [PHP Upload Exploit]

'/home/boomerang/public_html/images/stat.php'
# (quarantined to /cuarentena/cxsuser/boomerang/stat.php.1496674692_1) Known exploit = [Fingerprint Match] [PHP Exploit]

'/home/boomerang/public_html/images/tmp.php'
# (quarantined to /cuarentena/cxsuser/boomerang/tmp.php.1496674692_1) (decoded file [advanced decoder: 14 (depth: 4)]) Known exploit = [Fingerprint Match] [PHP Obfuscation Exploit [P0835]]

'/home/boomerang/public_html/includes/framework.php'
# (quarantined to /cuarentena/cxsuser/boomerang/framework.php.1496674694_1) (decoded file [advanced decoder: 14 (depth: 1)]) Known exploit = [Fingerprint Match] [PHP Obfuscation Exploit [P0803]]

'/home/boomerang/public_html/libraries/cms/version/version.php'
# Script version check [OLD] [Joomla v3.6.4 < v3.7.2]

'/home/boomerang/public_html/media/media/js/silverlightmediaelement.xap'
# (compressed file: SilverlightMediaElement.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec]

'/home/boomerang/public_html/portalbeta/administrator/components/com_joomlaupdate/restore.php'
# Regular expression match = [symlink\s*\(]

'/home/boomerang/public_html/portalbeta/administrator/logs'
# World writeable directory

'/home/boomerang/public_html/portalbeta/components/com_comprofiler/js/jquery/silverlightmediaelement.xap'
# (compressed file: SilverlightMediaElement.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec]

'/home/boomerang/public_html/portalbeta/images/bouncer'
# (quarantined to /cuarentena/cxsuser/boomerang/bouncer.1496674765_1) ClamAV detected virus = [Unix.Malware.Agent-1434809]

'/home/boomerang/public_html/portalbeta/images/cache_log.php'
# (quarantined to /cuarentena/cxsuser/boomerang/cache_log.php.1496674765_1) Known exploit = [Fingerprint Match] [PHP Obfuscation Exploit [P0877]]

'/home/boomerang/public_html/portalbeta/images/imagick.php'
# (quarantined to /cuarentena/cxsuser/boomerang/imagick.php.1496674765_1) Known exploit = [Fingerprint Match] [PHP Upload Exploit]

'/home/boomerang/public_html/portalbeta/images/stat.php'
# (quarantined to /cuarentena/cxsuser/boomerang/stat.php.1496674766_1) Known exploit = [Fingerprint Match] [PHP Exploit]

'/home/boomerang/public_html/portalbeta/images/tmp.php'
# (quarantined to /cuarentena/cxsuser/boomerang/tmp.php.1496674766_1) (decoded file [advanced decoder: 14 (depth: 4)]) Known exploit = [Fingerprint Match] [PHP Obfuscation Exploit [P0835]]

'/home/boomerang/public_html/portalbeta/images/banners'
# World writeable directory

'/home/boomerang/public_html/portalbeta/images/headers'
# World writeable directory

'/home/boomerang/public_html/portalbeta/images/sampledata'
# World writeable directory

'/home/boomerang/public_html/portalbeta/libraries/CBLib/CB/Legacy/Archive_Tar.php'
# Regular expression match = [symlink\s*\(]

'/home/boomerang/public_html/portalbeta/media/media/js/silverlightmediaelement.xap'
# (compressed file: SilverlightMediaElement.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec]

'/home/boomerang/public_html/portalomega/wp-content/uploads'
# World writeable directory

'/home/boomerang/public_html/portalomega/wp-content/uploads/2017'
# World writeable directory

'/home/boomerang/public_html/portalomega/wp-content/uploads/2017/05'
# World writeable directory

'/home/boomerang/public_html/portalomega/wp-content/uploads/wc-logs'
# World writeable directory

'/home/boomerang/public_html/portalomega/wp-content/uploads/woocommerce_uploads'
# World writeable directory

'/home/boomerang/public_html/portalomega/wp-includes/js/mediaelement/silverlightmediaelement.xap'
# (compressed file: SilverlightMediaElement.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec]

'/home/boomerang/public_html/portalomega/wp-includes/js/plupload/plupload.silverlight.xap'
# (compressed file: Moxie.dll [depth: 1]) MS Windows Binary/Executable [application/x-winexec]

'/home/boomerang/public_html/turbia/administrator/components/com_extplorer/include/mkitem.php'
# Regular expression match = [symlink\s*\(]

'/home/boomerang/public_html/turbia/administrator/components/com_extplorer/libraries/Tar.php'
# Regular expression match = [symlink\s*\(]

'/home/boomerang/public_html/turbia/administrator/components/com_joomlaupdate/restore.php'
# Regular expression match = [symlink\s*\(]

'/home/boomerang/public_html/turbia/components/com_weblinks/views/weblink/strtoupper.php'
# (quarantined to /cuarentena/cxsuser/boomerang/strtoupper.php.1496674905_1) Known exploit = [Fingerprint Match] [PHP Obfuscation Exploit [P1030]]

'/home/boomerang/public_html/turbia/images/stat.php'
# (quarantined to /cuarentena/cxsuser/boomerang/stat.php.1496674905_1) Known exploit = [Fingerprint Match] [PHP Exploit]

'/home/boomerang/public_html/turbia/libraries/cms/version/version.php'
# Script version check [OLD] [Joomla v3.4.8 < v3.7.2]

'/home/boomerang/var/cpanel/styled/current_style'
# Symlink to [/usr/local/cpanel/base/frontend/paper_lantern/styled/retro]

----------- SCAN SUMMARY -----------
Scanned directories: 9893
Scanned files: 38941
Ignored items: 179
Suspicious matches: 105
Viruses found: 3
Fingerprint matches: 12
Data scanned: 484.74 MB
Scan time/item: 0.008 sec
Scan time: 406.836 sec