Server scan: false positive?
-
Hi,
I had my server scanned for malware and this showed up in the results.
public_html/wp-content/bps-backup/mscan/mscan-pattern-match.php: YARA.imh_php_base64d_obfuscated.UNOFFICIAL FOUND
Is this a false positive or can I delete it?
Please let me know.
Thank you
-
Yep, it’s a false positive. Just ignore that if you are allowed to ignore it. The server malware scan found the MScan malware scan pattern matching code used to scan for malware. Very common problem and limitation of malware scanners. I’m doing a complete rebuild of MScan in the next BPS plugin version and am going to use a DB option that contains the MScan malware pattern matches instead of using the mscan-pattern-match.php file. Plugin and Theme files will now be checked by MD5 hashes like I have been doing with WP Core files. MD5 file hash comparison checking is 100% accurate vs pattern matching malware scans that are 75% accurate (lots of false positives and undetected malware) at best.
The topic ‘Server scan: false positive?’ is closed to new replies.
