For one of my sites I am using cpanel shared hosting and have received a malware notification about a file belonging to the fontawesome module.

The file is drush/fontawesome.drush.inc

Having run a diff check, the file is identical to the original so I am confident this is a false positive, but I thought it ought to be reported all the same. Having checked with the hosting company, I am told that they are using Maldet malware scanner.

It would be interesting to know what is triggering the alert.

Comments

MrPaulDriver created an issue. See original summary.

mrpauldriver’s picture

Version: 8.x-2.0-beta1 » 7.x-2.7
Issue summary: View changes
daniel.moberly’s picture

Status: Active » Closed (cannot reproduce)
daniel.moberly’s picture

Paul,

I'm not able to reproduce this at all. Anyone can please feel free to reopen this issue if you can give steps to reproduce.

mrpauldriver’s picture

Status: Closed (cannot reproduce) » Closed (duplicate)
daniel.moberly’s picture

Title: Malware false positive with fontawsome module » Drush file causes false malware alert
Status: Closed (duplicate) » Needs review
StatusFileSize
new1.45 KB

Attaching patch to fix this issue - maldet doesn't like the rm -rf command so I've changed the way the file extraction works to remove the need

  • Daniel.Moberly committed d84bcac on 7.x-2.x
    Issue #2944352 by Daniel.Moberly: Drush file causes false malware alert
    
daniel.moberly’s picture

Status: Needs review » Fixed
mrpauldriver’s picture

Good stuff. Thanks

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.