False Positive By Imunify On Helix Ultimate Core File (default.php)
S-D CONSULTING
When antimalware programs report false positives, do you report them (for example, Imunify)?
If necessary, I'll report the issue privately, otherwise it's alarming. However, I've already analyzed the file, and aside from containing many dynamic classes that may have bypassed Imunify's CloudAV algorithm, there's nothing wrong with it, and the file hasn't changed since May.
S-D CONSULTING
Accepted AnswerWhen I ask if you think about it, I'm obviously referring to the Helix development team.
Marin
Accepted AnswerDo you have any fix for this
S-D CONSULTING
Accepted AnswerI don't think there's a fix; I think it's a false positive from Imunify. I reported the issue to the Imunify developers via SSH, because the reporting is the result of their algorithm, but the file hasn't been modified in any way, and there are no non-compliant functions.
I believe Imunify is flagging it because of the many dynamic classes that likely exceed their standards.
Let's see what the Helix developers have to say.
Marin
Accepted AnswerThanks for the quick reply. I noticed that last night. However, as soon as I restore the file, Imunify360 deletes it, and without it, all our articles are blank—or rather, they don't display.
S-D CONSULTING
Accepted AnswerThis morning, I also received a report of an infected file from Imunify on all my servers on websites where Helix is used. This isn't the first time I've had a false positive, so before taking action, I checked the file and, strangely, the "differences" panel reported the entire contents of the offending file.
I ran an analysis of the file using advanced AI and found no anomalies. CloudAV likely detects many dynamic classes that exceed their standards and is therefore flagging them.
I'll wait to see what the Helix developers say. I reported the false positive to Imunify and asked them to investigate.
Marin
Accepted AnswerHow long does it take for Imunify360 to process things if there’s a false positive? It’s quite a hassle because none of the articles are displaying. Interestingly, out of 17 websites, the file was flagged as malware on 15 of them, but not on the other two.
S-D CONSULTING
Accepted AnswerYou should disable the automatic cleaning feature; it's a significant risk. There's a whitelist for some files after a false positive occurs.
copycat
Accepted Answercould you please confirm the exact full server path of the file that Imunify360 is removing?
copycat
Accepted AnswerHow can this issue be solved when the hosting provider does not allow any whitelist/ignore functionality in Imunify360?
Is there any alternative method to stop Imunify360 from removing the file?
could you please confirm the exact full server path of the file that Imunify360 is removing?
S-D CONSULTING
Accepted AnswerYour provider shouldn't have Imunify automatically cleaning files, as this could compromise a website with a false positive.
Imunify has a feature to prevent this, depending on whether your provider offers the option to receive notifications, but without automatic intervention.
Łukasz
Accepted Answerpublic_html/plugins/system/helixultimate/overrides/com_content/article/default.php
Ziaul Kabir
Accepted AnswerHello @all,
Thank you for bringing this to our attention.
We can confirm this is a false positive from Imunify360. The file default.php in Helix Ultimate is part of the original and legitimate source code and does not contain any malicious content.
This detection has been reported by other users as well and is related to the security scanner’s signature pattern rather than any real threat.
As a temporary workaround, please stop scanning or exclude this file from Imunify360 until we have contacted them and clarified the issue, or apply an exclusion rule for this specific file to prevent it from being removed or zeroed out.
We appreciate your understanding and will update you once we have more information.
Thanks
Ziaul Kabir
Accepted AnswerThanks for your patience.
The Imunify360 security team has resolved the false-positive issue. Please update your malware signatures and run a new scan. The file should no longer be flagged.
If you still encounter the detection after updating and rescanning, please let us know, and we'll investigate further.