Title: quttera STILL searching everything Last modified: June 5, 2022 --- # quttera STILL searching everything * Resolved [edwardsmark](https://wordpress.org/support/users/edwardsmark/) * (@edwardsmark) * [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/) * hello – i previously raised this issue here: * [https://wordpress.org/support/topic/quttera-searching-everything/](https://wordpress.org/support/topic/quttera-searching-everything/) * sorry to bring this up again, but two years into it, this is still a big issue for us. it would be great if we could somehow whitelist specific files by the file suffix. * in the prior post, you asked for an example file header, and here is a new one: * # od -cx Screen_Spont_2022-05-23-10-22-56-PM.opus | head -25 0000000 O g g S\ 0 002 \0 \0 \0 \0 \0 \0 \0 \0 025 d 674f 5367 0200 0000 0000 0000 0000 6415 0000020 F j \0 \0 \0 \0 335 L \t 017 001 023 O p u s 6a46 0000 0000 4cdd 0f09 1301 704f 7375 0000040 H e a d 001 001 8 001 200 273 \0 \0 \0 \0 \0 O 6548 6461 0101 0138 bb80 0000 0000 4f00 0000060 g g S \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 025 d F 6767 0053 0000 0000 0000 0000 1500 4664 0000100 j 001 \0 \0 \0 177 342 W 202 001 034 O p u s T 016a 0000 7f00 57e2 0182 4f1c 7570 5473 0000120 a g s \f \0 \0 \0 M o r p h b o x . 6761 0c73 0000 4d00 726f 6870 6f62 2e78 0000140 c o m \0 \0 \ 0 \0 O g g S \0 \0 \0 207 \0 6f63 006d 0000 4f00 6767 0053 0000 0087 0000160 \ 0 \0 \0 \0 \0 025 d F j 002 \0 \0 \0 275 s C 0000 0000 1500 4664 026a 0000 bd00 4373 0000200 5 024 331 375 355 361 365 374 371 347 377 016 377 022 363 344 1435 fdd9 f1ed fcf5 e7f9 0eff 12ff e4f3 0000220 335 357 353 343 330 333 z ^ \0 255 > 025 244 p 317 370 efdd e3eb dbd8 5e7a ad00 153e 70a4 f8cf 0000240 2 372 200 303 – P 235 265 203 303 > 8 276 ‘ \n 232 fa32 c380 502d b59d c383 383e 27be 9a0a 0000260 350 + _ 4 375 X v 031 227 324 200 } z 361 # 003 2be8 345f 58fd 1976 d497 7d80 f17a 0323 0000300 v 034 D | \r 215 246 311 004 9 c 371 022 326 222 003` Viewing 7 replies - 1 through 7 (of 7 total) * Thread Starter [edwardsmark](https://wordpress.org/support/users/edwardsmark/) * (@edwardsmark) * [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/#post-15710322) * ``` # od -cx Screen_Spont_2022-05-23-10-22-56-PM.opus | head -25 0000000 O g g S \0 002 \0 \0 \0 \0 \0 \0 \0 \0 025 d 674f 5367 0200 0000 0000 0000 0000 6415 0000020 F j \0 \0 \0 \0 335 L \t 017 001 023 O p u s 6a46 0000 0000 4cdd 0f09 1301 704f 7375 0000040 H e a d 001 001 8 001 200 273 \0 \0 \0 \0 \0 O 6548 6461 0101 0138 bb80 0000 0000 4f00 0000060 g g S \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 025 d F 6767 0053 0000 0000 0000 0000 1500 4664 0000100 j 001 \0 \0 \0 177 342 W 202 001 034 O p u s T 016a 0000 7f00 57e2 0182 4f1c 7570 5473 0000120 a g s \f \0 \0 \0 M o r p h b o x . 6761 0c73 0000 4d00 726f 6870 6f62 2e78 0000140 c o m \0 \0 \0 \0 O g g S \0 \0 \0 207 \0 6f63 006d 0000 4f00 6767 0053 0000 0087 0000160 \0 \0 \0 \0 \0 025 d F j 002 \0 \0 \0 275 s C 0000 0000 1500 4664 026a 0000 bd00 4373 0000200 5 024 331 375 355 361 365 374 371 347 377 016 377 022 363 344 1435 fdd9 f1ed fcf5 e7f9 0eff 12ff e4f3 0000220 335 357 353 343 330 333 z ^ \0 255 > 025 244 p 317 370 efdd e3eb dbd8 5e7a ad00 153e 70a4 f8cf 0000240 2 372 200 303 - P 235 265 203 303 > 8 276 ' \n 232 fa32 c380 502d b59d c383 383e 27be 9a0a 0000260 350 + _ 4 375 X v 031 227 324 200 } z 361 # 003 2be8 345f 58fd 1976 d497 7d80 f17a 0323 0000300 v 034 D | \r 215 246 311 004 9 c 371 022 326 222 003 ``` * Plugin Author [quttera](https://wordpress.org/support/users/quttera/) * (@quttera) * [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/#post-15710436) * Thank you for reporting this issue. * Opus files should be supported by the plugin and should be skipped. * File: qtrMimetype.php, line 30. * Can you please send us an email with the first 100 bytes of this file to support[ at]quttera[dot]com for further investigation? * Please mention in the request to forward this request to R&D * Thank you. - This reply was modified 3 years, 10 months ago by [quttera](https://wordpress.org/support/users/quttera/). * Thread Starter [edwardsmark](https://wordpress.org/support/users/edwardsmark/) * (@edwardsmark) * [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/#post-15710573) * hello – thank you for your prompt reply. * i just sent the first 30 lines of qtrMimetype.php to the requested email address? * sorry, but i am not sure what you meant by the first 100 bytes since i thought that was included in the hex-dump? here is the first 100 lines of the hex-dump but i also sent several of the Opus files in a zip file. please tell me if this is sufficient. * ``` # od -cx Screen_Spont_2022-05-23-10-22-56-PM.opus | head -100 od -cx Screen_Spont_2022-05-23-10-22-56-PM.opus | head -100 0000000 O g g S \0 002 \0 \0 \0 \0 \0 \0 \0 \0 025 d 674f 5367 0200 0000 0000 0000 0000 6415 0000020 F j \0 \0 \0 \0 335 L \t 017 001 023 O p u s 6a46 0000 0000 4cdd 0f09 1301 704f 7375 0000040 H e a d 001 001 8 001 200 273 \0 \0 \0 \0 \0 O 6548 6461 0101 0138 bb80 0000 0000 4f00 0000060 g g S \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 025 d F 6767 0053 0000 0000 0000 0000 1500 4664 0000100 j 001 \0 \0 \0 177 342 W 202 001 034 O p u s T 016a 0000 7f00 57e2 0182 4f1c 7570 5473 0000120 a g s \f \0 \0 \0 M o r p h b o x . 6761 0c73 0000 4d00 726f 6870 6f62 2e78 0000140 c o m \0 \0 \0 \0 O g g S \0 \0 \0 207 \0 6f63 006d 0000 4f00 6767 0053 0000 0087 0000160 \0 \0 \0 \0 \0 025 d F j 002 \0 \0 \0 275 s C 0000 0000 1500 4664 026a 0000 bd00 4373 0000200 5 024 331 375 355 361 365 374 371 347 377 016 377 022 363 344 1435 fdd9 f1ed fcf5 e7f9 0eff 12ff e4f3 0000220 335 357 353 343 330 333 z ^ \0 255 > 025 244 p 317 370 efdd e3eb dbd8 5e7a ad00 153e 70a4 f8cf 0000240 2 372 200 303 - P 235 265 203 303 > 8 276 ' \n 232 fa32 c380 502d b59d c383 383e 27be 9a0a 0000260 350 + _ 4 375 X v 031 227 324 200 } z 361 # 003 2be8 345f 58fd 1976 d497 7d80 f17a 0323 0000300 v 034 D | \r 215 246 311 004 9 c 371 022 326 222 003 1c76 7c44 8d0d c9a6 3904 f963 d612 0392 0000320 p 276 252 p 231 030 360 $ t 023 323 } - \f 257 be70 70aa 1899 24f0 2074 d313 2d7d af0c 0000340 036 * 222 260 0 V 377 213 005 213 Q 5 T 351 333 377 2a1e b092 5630 8bff 8b05 3551 e954 ffdb 0000360 030 ! 251 206 W 350 " 023 7 211 325 200 S 004 245 * 2118 86a9 e857 1322 8937 80d5 0453 2aa5 0000400 } v 302 C 356 177 023 \t 5 265 A E 023 D 233 0 767d 43c2 7fee 0913 b535 4541 4413 309b 0000420 020 ( 343 " 3 363 212 M e 254 234 \t 1 211 9 A 2810 22e3 f333 4d8a ac65 099c 8931 4139 0000440 6 320 024 330 R 334 - 214 & z 031 177 375 257 254 246 d036 d814 dc52 8c2d 7a26 7f19 affd a6ac 0000460 y < 6 g 1 3 % 350 n 344 w i k 226 f 302 3c79 6736 3331 e825 e46e 6977 966b c266 0000500 177 350 3 ^ g 245 S 315 202 351 J ``` * 342 ” 321 345 e87f 5e33 a567 cd53 e982 604a 22e2 e5d1 0000520 335 216 X 234 264 206 377 H 356 326 \ 6 ` 5 273 256 8edd 9c58 86b4 48ff d6ee 365c 3560 aebb 0000540 333 327 351 _ 311 262 207 177 254 373 365 235 023 317 232 z d7db 5fe9 b2c9 7f87 fbac 9df5 cf13 7a9a 0000560 204 200 c z X n q 2 236 G 321 241 254 336 4 n 8084 7a63 6e58 3271 479e a1d1 deac 6e34 0000600 237 374 342 242 262 i 205 340 % 227 333 265 035 203 243 o fc9f a2e2 69b2 e085 9725 b5db 831d 6fa3 0000620 004 324 325 1 350 9 335 5 d \b 344 \f 256 321 226 313 d404 31d5 39e8 35dd 0864 0ce4 d1ae cb96 0000640 272 375 352 ^ 021 s { 212 246 365 317 / U V : 236 fdba 5eea 7311 8a7b f5a6 2fcf 5655 9e3a 0000660 \n 331 031 & 222 334 N 211 & A 207\ r 306 f L 177 d90a 2619 dc92 894e 4126 0d87 66c6 7f4c 0000700 g 215 + 240 ] 261 020 331 342 365 ? S 3 270 307 \a 8d67 a02b b15d d910 f5e2 533f b833 07c7 0000720 366 272 230 360 O \t ) 237 + 327 307 k F ( 226 * baf6 f098 094f 9f29 d72b 6bc7 2846 2a96 0000740 F _ 367 C U * 214 | 203 242 o N 004 341 e 027 5f46 43f7 2a55 7c8c a283 4e6f e104 1765 0000760 026 034 K 247 N 210 < e 353 201 344 245 ” 203 002 1c16 a74b 884e 653c 20eb e481 22a5 0283 0001000 212 307 334 9 360 i r 330 016 374 177 c T G e H c78a 39dc 69f0 d872 fc0e 637f 4754 4865 0001020 002 z ‘ 236 215 A 006 202 204 D 222 276 227 V 276 264 7a02 9e27 418d 8206 4484 be92 5697 b4be 0001040 Y . 024 2 005 5 216 u 305 @ 9 v l ( W g 2e59 3214 3505 758e 40c5 7639 286c 6757 0001060 k 017 224 272 A 355 \v 326 : R 360 316 230 l 201 277 0f6b ba94 ed41 d60b 523a cef0 6c98 bf81 0001100 212 203 f 177 363 \ 263 275 9 241 223 + 032 267 302 % 838a 7f66 5cf3 bdb3 a139 2b93 b71a 25c2 0001120 ` 303 ; 265 h 342 357 e 256 341 221 252 0 P 325 003 c360 b53b e268 65ef e1ae aa91 5030 03d5 0001140 U 344 353 377 206 F 226 211 360 024 251 245 z r ‘ f e455 ffeb 4686 8996 14f0 a5a9 727a 6627 0001160 W 265 } 032 264 353 f 001 U 351 307 373 { 354 212 373 b557 1a7d ebb4 0166 e955 fbc7 ec7b fb8a 0001200 343 377 273 336 223 331 273_ 201 251 003 344 213 ) 331 326 ffe3 debb d993 5fbb a981 e403 298b d6d9 0001220\ f 002 373 345 035 4 343 % * 261 { 230 336 I ? R 020c e5fb 341d 25e3 b12a 987b 49de 523f 0001240 326 f 353 _ 022 034 A 307 _ 321 ^ . 030 365 j 334 66d6 5feb 1c12 c741 d15f 2e5e f518 dc6a 0001260 n 272 q g 304 377 207 277 = \0 307 323 2 } 351 n ba6e 6771 ffc4 bf87 003d d3c7 7d32 6ee9 0001300 246 266 B 025 207 027 250 300 314 006 364 \t 217 355 350 275 b6a6 1542 1787 c0a8 06cc 09f4 ed8f bde8 0001320 312 ) 332 327 217 223 O 336 335 e 313 247 1 034 * 29ca d7da 938f 204f ddde cb65 31a7 2a1c 0001340 % 8 242 241 327 W 311 301 220 i $ # 325 ^ 375 213 3825 a1a2 57d7 c1c9 6990 2324 5ed5 8bfd 0001360 016 203 q 253 202 003 j O 307 373 204 353 x j 376 9 830e ab71 0382 4f6a fbc7 eb84 6a78 39fe 0001400 : 203 004 2 235 311 336 n 004 h v 226 006 a Y 367 833a 3204 c99d 6ede 6804 9676 6106 f759 0001420 6 R I 331 q 257 f P 204 302 D 377 6 212 215 031 5236 d949 af71 5066 c284 ff44 8a36 198d` * Thread Starter [edwardsmark](https://wordpress.org/support/users/edwardsmark/) * (@edwardsmark) * [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/#post-15710581) * or this? * ``` # head --bytes=100 Screen_Spont_2022-05-23-10-22-56-PM.opus | od -cx ; 0000000 O g g S \0 002 \0 \0 \0 \0 \0 \0 \0 \0 025 d 674f 5367 0200 0000 0000 0000 0000 6415 0000020 F j \0 \0 \0 \0 335 L \t 017 001 023 O p u s 6a46 0000 0000 4cdd 0f09 1301 704f 7375 0000040 H e a d 001 001 8 001 200 273 \0 \0 \0 \0 \0 O 6548 6461 0101 0138 bb80 0000 0000 4f00 0000060 g g S \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 025 d F 6767 0053 0000 0000 0000 0000 1500 4664 0000100 j 001 \0 \0 \0 177 342 W 202 001 034 O p u s T 016a 0000 7f00 57e2 0182 4f1c 7570 5473 0000120 a g s \f \0 \0 \0 M o r p h b o x . 6761 0c73 0000 4d00 726f 6870 6f62 2e78 0000140 c o m \0 6f63 006d ``` * Plugin Author [quttera](https://wordpress.org/support/users/quttera/) * (@quttera) * [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/#post-15710606) * I appologize for the confusion, * The following command should copy the first 100 bytes of the file Screen_Spont_2022- 05-23-10-22-56-PM.opus and will store it in header.opus in binary format * # **dd if=Screen_Spont_2022-05-23-10-22-56-PM.opus of=header.opus bs=100 count =1** * Can you please send us the generated header.opus file to the mentioned email? * We will use it to reproduce the detection issue on our side. * Thank you. * Thread Starter [edwardsmark](https://wordpress.org/support/users/edwardsmark/) * (@edwardsmark) * [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/#post-15710779) * ``` # dd if=Screen_Spont_2022-05-23-10-22-56-PM.opus of=header.opus bs=100 count=1 1+0 records in 1+0 records out 100 bytes copied, 0.0126386 s, 7.9 kB/s ``` * Thread Starter [edwardsmark](https://wordpress.org/support/users/edwardsmark/) * (@edwardsmark) * [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/#post-15710781) * file header.opus emailed. Viewing 7 replies - 1 through 7 (of 7 total) The topic ‘quttera STILL searching everything’ is closed to new replies. * ![](https://ps.w.org/quttera-web-malware-scanner/assets/icon-256x256.png?rev= 2902086) * [Quttera ThreatSign – Web Malware Scanner for WordPress](https://wordpress.org/plugins/quttera-web-malware-scanner/) * [Frequently Asked Questions](https://wordpress.org/plugins/quttera-web-malware-scanner/#faq) * [Support Threads](https://wordpress.org/support/plugin/quttera-web-malware-scanner/) * [Active Topics](https://wordpress.org/support/plugin/quttera-web-malware-scanner/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/quttera-web-malware-scanner/unresolved/) * [Reviews](https://wordpress.org/support/plugin/quttera-web-malware-scanner/reviews/) * 7 replies * 2 participants * Last reply from: [edwardsmark](https://wordpress.org/support/users/edwardsmark/) * Last activity: [3 years, 10 months ago](https://wordpress.org/support/topic/quttera-still-searching-everything/#post-15710781) * Status: resolved