ImunifyAV/Imunify360 started flagging multiple files as malware

[NovaNvyvbeige6s]

Hi everyone,

I’ve recently encountered an issue on a Plesk server where ImunifyAV/Imunify360 started flagging multiple files as malware, even though they appear to be legitimate system binaries.

Specifically:

Files like /usr/bin/cat, libraries, and other ELF binaries
Located in paths such as:
/var/www/vhosts/system/<domain>/... or /var/www/vhosts/<domain>/usr/bin/
Detected as suspicious just because they are ELF binaries

From my analysis, these look like standard GNU/Linux binaries (e.g. GNU coreutils) and seem to be related to Plesk’s chroot/jail environment for subscriptions.

I also found this explanation from Plesk documentation:
https://support.plesk.com/hc/en-us/a...12377661896343

It suggests that Plesk creates these environments and copies system binaries there, which would explain their presence.

My questions:

1. Are you experiencing the same issue recently?
2. Did Imunify start flagging these files more aggressively for you as well?
3. Are you treating this as false positives, or did you take any specific action (ignore rules, config changes, etc.)?

At the moment it looks like a false positive caused by heuristic ELF detection, but I’d like to confirm if others are seeing the same behavior.

Thanks in advance for any insights.

[akots]

Thank you for the details!
Consulted with the Imunify Team - they've opened an internal case for this, and our malware processing team is on it (DEF-40647). We are excluding the paths generated by the Plesk chrootshell.

[akots]

Hello,

From what I can see, these detections appear to be related to legitimate binary files located under the account path, which can be flagged by Imunify’s Binary (ELF) malware detection. This may happen, for example, when such files are present as part of a chrooted environment or similar setup.

(1-2) We do not currently see this as a widespread recent pattern on our side. Also, at the moment, we do not have signs that Imunify started flagging these files more aggressively in general.

(3) If these files are expected and trusted on your server, this would be considered a false positive. In this case, you have a few options:

1. Report the detected files as false positive: https://cloudlinux.zendesk.com/hc/en...gative-results
2. Ignore them if you have already confirmed they are legitimate: https://cloudlinux.zendesk.com/hc/en...alware-scanner
3. Apply the workaround from https://cloudlinux.zendesk.com/hc/en...-as-malicious:
   • disable Binary (ELF) malware detection, or
   • move such binaries to a dedicated directory and add that directory to the ignore list.

Please note that disabling ELF binary detection may reduce the protection scope, so the ignore-list approach is usually the safer option if these files are known to be legitimate.

[NovaNvyvbeige6s]

Hi, I assume that’s the case. This notification has been appearing for a few days now. It detects exactly 59 files in those subscriptions where these executable files are located in the usr directory. Previously, this didn’t happen at all, but now the same message appears in all subscriptions that contain these files.

I don’t want to add this to the exclusion list. I believe this should be handled on your side, so you can analyze why your software is detecting it this way. I don’t want to add it to exclusions to avoid accidentally overlooking something later.

I have scanned several of these files, and none of the executables appear to be viruses or anything suspicious.

[akots]

Thanks for a quick reply, got it.

Could you please share the Imunify version you are using? e.g.:

rpm -qa |  grep imunify

I am also interested in the antivirus module version so that I can consult it internally with our colleagues.

[NovaNvyvbeige6s]

imunifr-antivirus - 8.7.1-1
imunify-ui-8.10.1-2
imunifr-core - 8.9.0-3

[akots]

Thank you for the details!
Consulted with the Imunify Team - they've opened an internal case for this, and our malware processing team is on it (DEF-40647). We are excluding the paths generated by the Plesk chrootshell.