Support » Plugin: Quttera Web Malware Scanner » quttera STILL searching everything

quttera STILL searching everything

  • Resolved edwardsmark

    (@edwardsmark)


    1 year, 3 months ago

    hello – i previously raised this issue here:

    https://wordpress.org/support/topic/quttera-searching-everything/

    sorry to bring this up again, but two years into it, this is still a big issue for us. it would be great if we could somehow whitelist specific files by the file suffix.

    in the prior post, you asked for an example file header, and here is a new one:

    # od -cx Screen_Spont_2022-05-23-10-22-56-PM.opus | head -25
    0000000 O g g S \0 002 \0 \0 \0 \0 \0 \0 \0 \0 025 d
    674f 5367 0200 0000 0000 0000 0000 6415
    0000020 F j \0 \0 \0 \0 335 L \t 017 001 023 O p u s
    6a46 0000 0000 4cdd 0f09 1301 704f 7375
    0000040 H e a d 001 001 8 001 200 273 \0 \0 \0 \0 \0 O
    6548 6461 0101 0138 bb80 0000 0000 4f00
    0000060 g g S \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 025 d F
    6767 0053 0000 0000 0000 0000 1500 4664
    0000100 j 001 \0 \0 \0 177 342 W 202 001 034 O p u s T
    016a 0000 7f00 57e2 0182 4f1c 7570 5473
    0000120 a g s \f \0 \0 \0 M o r p h b o x .
    6761 0c73 0000 4d00 726f 6870 6f62 2e78
    0000140 c o m \0 \0 \0 \0 O g g S \0 \0 \0 207 \0
    6f63 006d 0000 4f00 6767 0053 0000 0087
    0000160 \0 \0 \0 \0 \0 025 d F j 002 \0 \0 \0 275 s C
    0000 0000 1500 4664 026a 0000 bd00 4373
    0000200 5 024 331 375 355 361 365 374 371 347 377 016 377 022 363 344
    1435 fdd9 f1ed fcf5 e7f9 0eff 12ff e4f3
    0000220 335 357 353 343 330 333 z ^ \0 255 > 025 244 p 317 370
    efdd e3eb dbd8 5e7a ad00 153e 70a4 f8cf
    0000240 2 372 200 303 – P 235 265 203 303 > 8 276 ‘ \n 232
    fa32 c380 502d b59d c383 383e 27be 9a0a
    0000260 350 + _ 4 375 X v 031 227 324 200 } z 361 # 003
    2be8 345f 58fd 1976 d497 7d80 f17a 0323
    0000300 v 034 D | \r 215 246 311 004 9 c 371 022 326 222 003`

Viewing 7 replies - 1 through 7 (of 7 total)
  • Thread Starter edwardsmark

    (@edwardsmark)

    1 year, 3 months ago

    # od -cx   Screen_Spont_2022-05-23-10-22-56-PM.opus  | head -25
0000000   O   g   g   S  \0 002  \0  \0  \0  \0  \0  \0  \0  \0 025   d
           674f    5367    0200    0000    0000    0000    0000    6415
0000020   F   j  \0  \0  \0  \0 335   L  \t 017 001 023   O   p   u   s
           6a46    0000    0000    4cdd    0f09    1301    704f    7375
0000040   H   e   a   d 001 001   8 001 200 273  \0  \0  \0  \0  \0   O
           6548    6461    0101    0138    bb80    0000    0000    4f00
0000060   g   g   S  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0 025   d   F
           6767    0053    0000    0000    0000    0000    1500    4664
0000100   j 001  \0  \0  \0 177 342   W 202 001 034   O   p   u   s   T
           016a    0000    7f00    57e2    0182    4f1c    7570    5473
0000120   a   g   s  \f  \0  \0  \0   M   o   r   p   h   b   o   x   .
           6761    0c73    0000    4d00    726f    6870    6f62    2e78
0000140   c   o   m  \0  \0  \0  \0   O   g   g   S  \0  \0  \0 207  \0
           6f63    006d    0000    4f00    6767    0053    0000    0087
0000160  \0  \0  \0  \0  \0 025   d   F   j 002  \0  \0  \0 275   s   C
           0000    0000    1500    4664    026a    0000    bd00    4373
0000200   5 024 331 375 355 361 365 374 371 347 377 016 377 022 363 344
           1435    fdd9    f1ed    fcf5    e7f9    0eff    12ff    e4f3
0000220 335 357 353 343 330 333   z   ^  \0 255   > 025 244   p 317 370
           efdd    e3eb    dbd8    5e7a    ad00    153e    70a4    f8cf
0000240   2 372 200 303   -   P 235 265 203 303   >   8 276   '  \n 232
           fa32    c380    502d    b59d    c383    383e    27be    9a0a
0000260 350   +   _   4 375   X   v 031 227 324 200   }   z 361   # 003
           2be8    345f    58fd    1976    d497    7d80    f17a    0323
0000300   v 034   D   |  \r 215 246 311 004   9   c 371 022 326 222 003
    Plugin Author quttera

    (@quttera)

    1 year, 3 months ago

    Thank you for reporting this issue.

    Opus files should be supported by the plugin and should be skipped.

    File: qtrMimetype.php, line 30.

    Can you please send us an email with the first 100 bytes of this file to support[at]quttera[dot]com for further investigation?

    Please mention in the request to forward this request to R&D

    Thank you.

    • This reply was modified 1 year, 3 months ago by quttera.
    Thread Starter edwardsmark

    (@edwardsmark)

    1 year, 3 months ago

    hello – thank you for your prompt reply.

    i just sent the first 30 lines of qtrMimetype.php to the requested email address?

    sorry, but i am not sure what you meant by the first 100 bytes since i thought that was included in the hex-dump? here is the first 100 lines of the hex-dump but i also sent several of the Opus files in a zip file. please tell me if this is sufficient.

    # od -cx   Screen_Spont_2022-05-23-10-22-56-PM.opus  | head -100
od -cx   Screen_Spont_2022-05-23-10-22-56-PM.opus  | head -100
0000000   O   g   g   S  \0 002  \0  \0  \0  \0  \0  \0  \0  \0 025   d
           674f    5367    0200    0000    0000    0000    0000    6415
0000020   F   j  \0  \0  \0  \0 335   L  \t 017 001 023   O   p   u   s
           6a46    0000    0000    4cdd    0f09    1301    704f    7375
0000040   H   e   a   d 001 001   8 001 200 273  \0  \0  \0  \0  \0   O
           6548    6461    0101    0138    bb80    0000    0000    4f00
0000060   g   g   S  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0 025   d   F
           6767    0053    0000    0000    0000    0000    1500    4664
0000100   j 001  \0  \0  \0 177 342   W 202 001 034   O   p   u   s   T
           016a    0000    7f00    57e2    0182    4f1c    7570    5473
0000120   a   g   s  \f  \0  \0  \0   M   o   r   p   h   b   o   x   .
           6761    0c73    0000    4d00    726f    6870    6f62    2e78
0000140   c   o   m  \0  \0  \0  \0   O   g   g   S  \0  \0  \0 207  \0
           6f63    006d    0000    4f00    6767    0053    0000    0087
0000160  \0  \0  \0  \0  \0 025   d   F   j 002  \0  \0  \0 275   s   C
           0000    0000    1500    4664    026a    0000    bd00    4373
0000200   5 024 331 375 355 361 365 374 371 347 377 016 377 022 363 344
           1435    fdd9    f1ed    fcf5    e7f9    0eff    12ff    e4f3
0000220 335 357 353 343 330 333   z   ^  \0 255   > 025 244   p 317 370
           efdd    e3eb    dbd8    5e7a    ad00    153e    70a4    f8cf
0000240   2 372 200 303   -   P 235 265 203 303   >   8 276   '  \n 232
           fa32    c380    502d    b59d    c383    383e    27be    9a0a
0000260 350   +   _   4 375   X   v 031 227 324 200   }   z 361   # 003
           2be8    345f    58fd    1976    d497    7d80    f17a    0323
0000300   v 034   D   |  \r 215 246 311 004   9   c 371 022 326 222 003
           1c76    7c44    8d0d    c9a6    3904    f963    d612    0392
0000320   p 276 252   p 231 030 360   $   t     023 323   }   -  \f 257
           be70    70aa    1899    24f0    2074    d313    2d7d    af0c
0000340 036   * 222 260   0   V 377 213 005 213   Q   5   T 351 333 377
           2a1e    b092    5630    8bff    8b05    3551    e954    ffdb
0000360 030   ! 251 206   W 350   " 023   7 211 325 200   S 004 245   *
           2118    86a9    e857    1322    8937    80d5    0453    2aa5
0000400   }   v 302   C 356 177 023  \t   5 265   A   E 023   D 233   0
           767d    43c2    7fee    0913    b535    4541    4413    309b
0000420 020   ( 343   "   3 363 212   M   e 254 234  \t   1 211   9   A
           2810    22e3    f333    4d8a    ac65    099c    8931    4139
0000440   6 320 024 330   R 334   - 214   &   z 031 177 375 257 254 246
           d036    d814    dc52    8c2d    7a26    7f19    affd    a6ac
0000460   y   <   6   g   1   3   % 350   n 344   w   i   k 226   f 302
           3c79    6736    3331    e825    e46e    6977    966b    c266
0000500 177 350   3   ^   g 245   S 315 202 351   J

    342 ” 321 345
    e87f 5e33 a567 cd53 e982 604a 22e2 e5d1
    0000520 335 216 X 234 264 206 377 H 356 326 \ 6 ` 5 273 256
    8edd 9c58 86b4 48ff d6ee 365c 3560 aebb
    0000540 333 327 351 _ 311 262 207 177 254 373 365 235 023 317 232 z
    d7db 5fe9 b2c9 7f87 fbac 9df5 cf13 7a9a
    0000560 204 200 c z X n q 2 236 G 321 241 254 336 4 n
    8084 7a63 6e58 3271 479e a1d1 deac 6e34
    0000600 237 374 342 242 262 i 205 340 % 227 333 265 035 203 243 o
    fc9f a2e2 69b2 e085 9725 b5db 831d 6fa3
    0000620 004 324 325 1 350 9 335 5 d \b 344 \f 256 321 226 313
    d404 31d5 39e8 35dd 0864 0ce4 d1ae cb96
    0000640 272 375 352 ^ 021 s { 212 246 365 317 / U V : 236
    fdba 5eea 7311 8a7b f5a6 2fcf 5655 9e3a
    0000660 \n 331 031 & 222 334 N 211 & A 207 \r 306 f L 177
    d90a 2619 dc92 894e 4126 0d87 66c6 7f4c
    0000700 g 215 + 240 ] 261 020 331 342 365 ? S 3 270 307 \a
    8d67 a02b b15d d910 f5e2 533f b833 07c7
    0000720 366 272 230 360 O \t ) 237 + 327 307 k F ( 226 *
    baf6 f098 094f 9f29 d72b 6bc7 2846 2a96
    0000740 F _ 367 C U * 214 | 203 242 o N 004 341 e 027
    5f46 43f7 2a55 7c8c a283 4e6f e104 1765
    0000760 026 034 K 247 N 210 < e 353 201 344 245 ” 203 002
    1c16 a74b 884e 653c 20eb e481 22a5 0283
    0001000 212 307 334 9 360 i r 330 016 374 177 c T G e H
    c78a 39dc 69f0 d872 fc0e 637f 4754 4865
    0001020 002 z ‘ 236 215 A 006 202 204 D 222 276 227 V 276 264
    7a02 9e27 418d 8206 4484 be92 5697 b4be
    0001040 Y . 024 2 005 5 216 u 305 @ 9 v l ( W g
    2e59 3214 3505 758e 40c5 7639 286c 6757
    0001060 k 017 224 272 A 355 \v 326 : R 360 316 230 l 201 277
    0f6b ba94 ed41 d60b 523a cef0 6c98 bf81
    0001100 212 203 f 177 363 \ 263 275 9 241 223 + 032 267 302 %
    838a 7f66 5cf3 bdb3 a139 2b93 b71a 25c2
    0001120 ` 303 ; 265 h 342 357 e 256 341 221 252 0 P 325 003
    c360 b53b e268 65ef e1ae aa91 5030 03d5
    0001140 U 344 353 377 206 F 226 211 360 024 251 245 z r ‘ f
    e455 ffeb 4686 8996 14f0 a5a9 727a 6627
    0001160 W 265 } 032 264 353 f 001 U 351 307 373 { 354 212 373
    b557 1a7d ebb4 0166 e955 fbc7 ec7b fb8a
    0001200 343 377 273 336 223 331 273 _ 201 251 003 344 213 ) 331 326
    ffe3 debb d993 5fbb a981 e403 298b d6d9
    0001220 \f 002 373 345 035 4 343 % * 261 { 230 336 I ? R
    020c e5fb 341d 25e3 b12a 987b 49de 523f
    0001240 326 f 353 _ 022 034 A 307 _ 321 ^ . 030 365 j 334
    66d6 5feb 1c12 c741 d15f 2e5e f518 dc6a
    0001260 n 272 q g 304 377 207 277 = \0 307 323 2 } 351 n
    ba6e 6771 ffc4 bf87 003d d3c7 7d32 6ee9
    0001300 246 266 B 025 207 027 250 300 314 006 364 \t 217 355 350 275
    b6a6 1542 1787 c0a8 06cc 09f4 ed8f bde8
    0001320 312 ) 332 327 217 223 O 336 335 e 313 247 1 034 *
    29ca d7da 938f 204f ddde cb65 31a7 2a1c
    0001340 % 8 242 241 327 W 311 301 220 i $ # 325 ^ 375 213
    3825 a1a2 57d7 c1c9 6990 2324 5ed5 8bfd
    0001360 016 203 q 253 202 003 j O 307 373 204 353 x j 376 9
    830e ab71 0382 4f6a fbc7 eb84 6a78 39fe
    0001400 : 203 004 2 235 311 336 n 004 h v 226 006 a Y 367
    833a 3204 c99d 6ede 6804 9676 6106 f759
    0001420 6 R I 331 q 257 f P 204 302 D 377 6 212 215 031
    5236 d949 af71 5066 c284 ff44 8a36 198d`

    Thread Starter edwardsmark

    (@edwardsmark)

    1 year, 3 months ago

    or this?

    # head --bytes=100 Screen_Spont_2022-05-23-10-22-56-PM.opus  | od -cx   ;
0000000   O   g   g   S  \0 002  \0  \0  \0  \0  \0  \0  \0  \0 025   d
           674f    5367    0200    0000    0000    0000    0000    6415
0000020   F   j  \0  \0  \0  \0 335   L  \t 017 001 023   O   p   u   s
           6a46    0000    0000    4cdd    0f09    1301    704f    7375
0000040   H   e   a   d 001 001   8 001 200 273  \0  \0  \0  \0  \0   O
           6548    6461    0101    0138    bb80    0000    0000    4f00
0000060   g   g   S  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0 025   d   F
           6767    0053    0000    0000    0000    0000    1500    4664
0000100   j 001  \0  \0  \0 177 342   W 202 001 034   O   p   u   s   T
           016a    0000    7f00    57e2    0182    4f1c    7570    5473
0000120   a   g   s  \f  \0  \0  \0   M   o   r   p   h   b   o   x   .
           6761    0c73    0000    4d00    726f    6870    6f62    2e78
0000140   c   o   m  \0
           6f63    006d
    Plugin Author quttera

    (@quttera)

    1 year, 3 months ago

    I appologize for the confusion,

    The following command should copy the first 100 bytes of the file Screen_Spont_2022-05-23-10-22-56-PM.opus and will store it in header.opus in binary format

    # dd if=Screen_Spont_2022-05-23-10-22-56-PM.opus of=header.opus bs=100 count=1

    Can you please send us the generated header.opus file to the mentioned email?

    We will use it to reproduce the detection issue on our side.

    Thank you.

    Thread Starter edwardsmark

    (@edwardsmark)

    1 year, 3 months ago

    # dd if=Screen_Spont_2022-05-23-10-22-56-PM.opus of=header.opus bs=100 count=1
1+0 records in
1+0 records out
100 bytes copied, 0.0126386 s, 7.9 kB/s
    Thread Starter edwardsmark

    (@edwardsmark)

    1 year, 3 months ago

    file header.opus emailed.

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘quttera STILL searching everything’ is closed to new replies.

Views