ImunifyAV: malware-scanning hook gets triggered when ignoring

[elham.fahmideh]

Hi,

Ive detected that the "malware-scanning" hook gets triggered when deleting a ignore file or folder from the cPanel plugin:

# ps aux | grep imuni

root     2298531 66.5  0.3 280016 54900 ?        R    12:59   0:02 /opt/alt/php73/usr/bin/php -n -d short_open_tag=on -d extension=json.so -d extension=mbstring.so -d extension=leveldb.so /opt/ai-bolit/ai-bolit-hoster.php --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster.db --no-html --json_report . --json-stdout --memory NoneM --listing /var/imunify360/tmp/tmp387qb_lz --progress /var/imunify360/tmp/ai_bolit_progress_15827327669387074.json --with-suspicious --size 1048576 --cloud-assist IP-76927-448245-Ydk8fJrf --cloudscan-size 10485760

# tail -f /var/log/imunify360/hook.log

1582733068 : 7901936a-28f6-4d22-8eb0-68aea9d4b9aa : started : malware-scanning : finished : /usr/local/xxxx/imunifyavscan_hook.sh

1582733071 : 7901936a-28f6-4d22-8eb0-68aea9d4b9aa : done : malware-scanning : finished : /usr/local/xxxx/imunifyavscan_hook.sh : OK

Is this normal behaviour?

Thanks,

Ignacio

[skhristich]

Hello Ignacio,
This shouldnt have happened, we need to check. Can you open a support ticket https://cloudlinux.zendesk.com/hc/en-us/requests/new so we can take a closer look at your system? You can post the ticket number here and well link this thread to it. Thank you.

[skhristich]

sorry my english..