"owned"

[magicker]

Hi all
after running Imnify for ever on a plesk server. After running the 1st scan on imunifyAV suddenly we have a LOT of readme.html file flagged that have clearly been there forever. Why would these suddenly be flagged (I am happy that they were) but not previously?

Is there a list of new signatures?

thanks

[alevchenko]

Hi,

The ImunifyAV changelog with recent version updates can be found here: https://changelog.imunify.com/imunify-av

What Imunify version are you using? Please share the output:

rpm -qa | grep imunify

[magicker]

does this help
imunify360-agent version
8.6.1
imunify-antivirus version
8.6.1
dpkg -l | grep imunify
ii imunify-antivirus 8.6.1-1 amd64 ImunifyAV agent
ii imunify-antivirus-plesk 8.6.1-1 amd64 ImunifyAV Plesk UI plugin
ii imunify-common 1.3.4-8 amd64 Imunify360 and ImunifyAV common utilities bundle
ii imunify-core 8.7.1-1 amd64 Imunify360 python dependencies
ii imunify-notifier 2.1.12-1 amd64 Imunify360 notifications service
ii imunify-release 1.0.1-1 amd64 Imunify Release package containing repository configuration and GPG key
ii imunify-ui 8.5.1-1 amd64 ImunifyUI package
ii imunify-ui-antivirus-plesk 8.5.1-1 amd64 ImunifyAV Plesk UI plugin
ii imunify360-venv 2.6.0-3 amd64 Imunify360 python dependencies

[alevchenko]

Thank you. Upon initial review, there are concerns that the recent updates may have an impact on this matter.

Could you provide your insights on the flagged files: is the detection accurate, or do you consider it a false positive?

To further clarify your initial inquiry, it would be helpful if you could specify the signature ID for the affected files.

[magicker]

Hi there

Just to clarify.

We have used the older default plesk extension for years with no indication of an issue

The 1st scan of the new AV extension flagged thousands of

SMW-BLKH-SA-CLOUDAV-deface-04983-0

We are wondering if this is the result of a new signature being added or a historic issue with the old extension

[alevchenko]

Appreciate your clarification.

I've reached out to our malware team to shed more light on this, and was advised that this can be better clarified through a support ticket, where we can initiate an internal task for them.

Please submit a ticket to our team at https://cloudlinux.zendesk.com/hc/en-us/requests/new and refer to this forum thread.
I will warn the Support Team about this case so that the ticket can be processed promptly.

Otherwise, please let me know if I can use the email you used on our forum to submit a ticket for you.

Surely, I'll update this thread on the outcome (: