ClamAV & False Positives

Hi nosilver4u,

Like several others I have been advised by our webhost about their malware scanner ‘catching’ alleged suspicious files. The initial e-mail from the host contained the following, which I have edited for brevity:

“I’m using a new malware scanner and protection system, and it has been catching what it sees as suspicious exe files in your ….. ewww-image-optimizer directory.

The scanner reported these files overnight:

……./ewww-image-optimizer/optipng.exe: Win.Adware.Softpulse-215 FOUND
……./ewww-image-optimizer/optipng.exe: Win.Adware.Softpulse-215 FOUND”

From the forum correspondence which I have seen I am aware that although ClamAV is declaring these files as malware, you are confident they are ‘false positives’.

Maybe I overreacted, but given my host’s concern, and not wanting to have our site taken down through no action on my part I, hopefully temporarily, deactivated and deleted EWWW Image Optimizer.

Since then I have been in regular contact with the host, and following my latest e-mail to them in which I gave them your own latest comments (taken from the forum) they have come back and commented as follows:

“We do run ClamAV but the files which are registering hits are Windows exe files that do not run on Linux. Removing those files will have no negative impact if you want to use the plugin, because on Linux the optimization is done with different binary files than those exe files.”

Would you be able to comment on on the Windows .exe files not running on Linux (their system), and what they say that “the optimization is done with diffrent binary files than those .exe files” ?

I do still want to use EWWW Image Optimizer, but the situation is getting a little confusing, as I have also read where you say that files such as optipng.exe are essential for the plugin to work.

Regards,

Alan

https://wordpress.org/plugins/ewww-image-optimizer/