Question Malware Question

[Ozzy47]

This don't have anything to do with the mod per say, but the other night my server sent me this.


malware detect scan report for hosting.wehostitbest.com:
SCAN ID: 092011-0403.21871
TIME: Sep 20 05:01:02 -0500
PATH: /home*/*/public_html
RANGE: 2 days
TOTAL FILES: 68575
TOTAL HITS: 5
TOTAL CLEANED: 0
NOTE: quarantine disabled; set quar_hits=1 in conf.maldet or run 'maldet -q 092011-0403.21871' to quarantine results FILE HIT LIST:
{HEX}gzbase64.inject.unclassed.14 : /home/freedomt/public_html/dbtech/vbarcade/media/pepperwater3sm/index.php
{HEX}gzbase64.inject.unclassed.14 : /home/myfriend/public_html/dbtech/vbarcade/media/armadillosm/index.php
{HEX}gzbase64.inject.unclassed.14 : /home/myfriend/public_html/dbtech/vbarcade/media/dragonhuntsm/index.php
{HEX}gzbase64.inject.unclassed.14 : /home/myfriend/public_html/dbtech/vbarcade/media/lettersgamesm/index.php
{HEX}gzbase64.inject.unclassed.14 : /home/myfriend/public_html/dbtech/vbarcade/media/pepperwater3sm/index.php
===============================================
Linux Malware Detect v1.3.7 < proj@rfxn.com >

Should I be concerned, like remove those games maybe?

 

[Darkwaltz4]

can you zip and paste the pepperwater3sm/dragonhuntsm games? im not sure why those even have index.php files; but vba diligently copies whatever it finds in the gamedata/upload folders, cuz you can never tell what a ipa/v3a game needs to run.

 

[Ozzy47]

Ok here ya go.

 

[Darkwaltz4]

Okay, both of those contain php files in their gamedata folder, which vbarcade properly copied along.

the php files are encrypted with codelock, so i cant read them to advise you on what they do - so up to you to decide if they are worth keeping on your server.

 

[Ozzy47]

I just deleted all 4 games in question just to be on the safe side, I think I have enough games to play with those gone.