ISPprotect.com malware scanner reports ScanForge issue?

  • Resolved peter.ode

    (@peterode)


    5 days ago

    On a Facebook post comment, I previously reported “no issues” after testing ScanForge on a few websites. Now, after doing a malware scan with ISPprotect.com, installed on my Ubuntu 24.04 server, it reports the following as Malware:

    “Malware {ISPP}suspect.eval.decode in /var/www/clients/client1/web2/web/wp-content/plugins/scanforge-db-security/includes/class-sfds-patterns.php”.

    I don’t know if that’s a false-positive or cause for concern?

    Please check and fix or explain if it is a false positive?

    Thank you.

Viewing 1 replies (of 1 total)
  • Plugin Author adnan.limdi

    (@adnanlimdi)

    4 days, 16 hours ago

    Thanks for reporting this. The flagged pattern is part of ScanForge’s database security detection logic. It contains strings related to eval and decoding that are used to identify potentially suspicious PHP code in database scans. A security scanner may flag these detection patterns because they resemble malware signatures, even when they are present as plain strings rather than being executed.

    This appears to be a potential false positive, not necessarily actual malware. However, we should verify the exact code before confirming that definitively. Thanks for bringing this to my attention!

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.

Tags