Gecko [ www.airco.bigpunchmedia.co.za ]

Name	Size	Permission	Date
KKnKd.php	34.65 KB	-r-xr-xr-x	2026-01-12 04:05
WgoeD.php	34.65 KB	-rw-r--r--	2025-11-18 03:31
bigpuxtb-clam.log	1.11 KB	-rw-r-----	2026-03-18 14:36
bigpuxtb-lf_scan.log	24.51 KB	-rw-r--r--	2026-03-18 14:36
bigpuxtb-scan-email	7.91 KB	-rw-r--r--	2026-03-18 14:37
clamips.log	19.97 KB	-rw-r--r--	2026-03-18 14:37
iqyyez.php	18.53 KB	-rw-r--r--	2026-01-12 04:05
wp-admin.php	24.37 KB	-rw-r--r--	2026-01-08 12:11

Rename

Hi There,

Hope this finds you well.

You have received this mail due to an event which triggered a 
virus/malware scan and your domain is infected.

Please attend to this as soon possible and update us with your confirmation
that this has been attended to.

Detection timestamp: Wed Mar 18 16:37:31 SAST 2026
Server IP: 197.242.144.105
Hostname: yakko.aserv.co.za

::::::::::::::::::::::::::::::::::::::::::::::::::
::: Recommended steps to resolve this incident :::
::::::::::::::::::::::::::::::::::::::::::::::::::

1. Login to cpanel > file manger and download the following files:

/home/bigpuxtb/clam_quarantine/
/home/bigpuxtb/clam_quarantine/bigpuxtb-clam.log   <-- known malicious virus/malware signatures
/home/bigpuxtb/clam_quarantine/bigpuxtb-lf_scan.log   <--- highly possible maliciously infected files

########################################################

2. Analyse the results from the provided scan logs and clean, remove or replace any infected 
or highly suspicious files.

Please feel free to access a scanning and patching application called patchman 
to get an idea of what's currently infected and you might be able to clean infected files 
from the patchman interface if this is not possible or cleaning options greyed out 
you will have to physically assess that particular file either clean, remove or replace.

To access patchman > login to cpanel > search for patchman.

2.1 Please also check email forwarders and filters and ensure that no unauthorized access has 
been made to your domains email accounts and no mail interception fraud is being attempted.

https://help.afrihost.com/topic/security/how-to-protect-yourself-from-email-interception-fraud
https://help.afrihost.com/topic/domains-and-hosting/how-to-manage-email-filters-in-cpanel

########################################################

3. look for any files in the report that have been flagged suspicious but have not 
been moved into quarantine. We suggest replacing these files with clean versions from 
the applications maintainers website.

########################################################

4. SECURING YOUR SITE

4.1. Generate a strong password combination [for account, ftp, database etc]

4.2. Don't use the admin username, change it to something less common.

4.3. Limit Login Attempts

In the case of a hacker or a bot attempting a brute-force attack to crack your password, 
it can be useful to limit the number of failed login attempts from a single IP address.

https://wordpress.org/plugins/limit-login-attempts/installation/

4.4. Protect your WordPress/joomla Admin Area

It is important to restrict the access to your WordPress admin area only to people that actually need access to it. 
If your site does not support registration or front-end content creation, your visitors should not be able to access your /wp-admin/ 
folder or the wp-login.php file. The best you can do is to get our home IP address (you can use a site like whatismyip.com for that) and 
add these lines to the .htaccess file in your WordPress admin folder replacing xx.xxx.xxx.xxx with your IP address.

# for wordpress
<Files wp-login.php>
 order deny,allow
 Deny from all
 allow from 169.0.0.0/16
 allow from 127.0.0.1
 allow from xx.xxx.xxx.xxx
</Files>

# for joomla or other aplication admin sections
# In the admin section folder create a .htaccess file if one doesn't exist or
# prepend if does exist the following:

<LIMIT GET POST>
 order deny,allow
 deny from all
 allow from 169.0.0.0/16
 allow from 127.0.0.1
 allow from xxx.xxx.xxx.xxx
</Limit>

4.5. Add additional protection against bot scans etc in the .htaccess file in public_html

# protect against humans scans
<IfModule mod_rewrite.c>
RewriteCond %{QUERY_STRING} http\:\/\/www\.google\.com\/humans\.txt\? [NC]
RewriteRule .* - [F,L]
</IfModule>

# deny POST request using HTTP 0.9 / 1.0
<IfModule mod_rewrite.c>
RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC]
RewriteRule .* - [F,L]
</IfModule>

4.6. Install web application firewall such as wordfence or rsfirewall

4.7. Password protection

Protect the admin/administration section (normally a folder) with additional
password protect Cpanel offers this control

4.8. If the application is not being used, please remove it entirely.

4.9. Remove all non-essential and disabled plugins.

Delete the extenstion files of any unnecessary extensions - only disabling an
extension will leave weak files in place.

4.10. Remove all/any old or unused applications ie: old wordpress installation in the public_html.

4.11. Disable unnecessary admin logins

4.12. Change the administration passwords for all administrators of the web applications backend.

Check that there are no newly created administrator users which you are unaware of.

4.13. Upgrade applications

Upgrade to the current version of the web application(s) or reinstall the web
application if it is already the current version.

4.14. Upgrade all plugins and modules, and if possible reinstall.

4.15. Change the database access password used by your application

4.16. Restrict IP access using htaccess to admin sections and upload sections to trusted IPs only

4.17. IP based acl's

Consider blocking by IP in folder specific htaccess files. eg: sign-up forms,
comments for forums, content management systems, and blogs, as this will
prevent many attacks.

4.18. Mail passwords

Set new passwords for all mail accounts where the length of the current
password is 7 letters or less. (With access to the account one can copy the
encrypted passwords, and decrypt simpler passwords by brute force.)

4.19. Trojans

Remove any modifications made to the web site content (e.g.  additional
administrator accounts, trojan plugins, spam edits to the beginning or the end
of the files, etc.) You can find some of these by looking for files with
recently modified timestamps.

4.20. Browser

Consider using a browser which will resist cross site scripting (XSS) attacks,
especially when doing administrative functions on the site (e.g. up to date
Chrome or Firefox with the NoScript plugin). This is important if the content
of your site has been modified to link to malware.

4.21. Permissions

Use the file manager or FTP to set permissions on the your configuration files
and their parent directory so that these cannot be read (ie. drwx--x--x, 0711).

4.22. Problems with backups

Understand that if you do restore the account from a backup you will restore
the account to its vulnerable state, and you may also reinstate the
modifications made by the intruders.

4.23. Desktop systems

Examine the desktop systems which are used for administering this site for
malware (viruses, keyloggers) with up to date security software, especially if
it seems that the intruder had access to your administration passwords.

4.24. Think

Consider that there may be more to this problem than meets the eye: for
example, the offending file or content may be present on desktop systems that
are associated with this account.
 
4.25. Shared passwords, software

The same applications, plugins, themes and passwords that led to the incident
on this account may be in use on other accounts. Please be sure to update not
only this account, but also the other accounts which are similarly vulnerable
to intruders.

4.26 Known-bad software

Check whether any extensions listed on the vulnerable extensions list are in
your installation:

Joomla : http://vel.joomla.org/

Wordpress : https://wordpress.org/plugins/tags/vulnerability

########################################################

5. After fixing the problem

Please attend to this as soon possible and update us with your confirmation
that this has been attended to.

We will then review the domain and remove the password protection or ZA IP restrictions.

Or you are more than welcome to remove the ZA IP restrictions in the htaccess file.

We apologise for the negative impact caused, but this was all carried out to protect 
the reputation of your domain and the server's IP.

########################################################