AV now flagging malware

Same here, imunifyAV in cPanel is seeing these as php_malware.id_SMW-HEUR-ELF :
ewww-image-optimizer/binaries/gifsicle-fbsd
ewww-image-optimizer/binaries/gifsicle-linux
ewww-image-optimizer/binaries/optipng-fbsd
ewww-image-optimizer/binaries/pngquant-fbsd
ewww-image-optimizer/binaries/pngquant-linux

It was doing the same thing here a year ago:
https://www.ads-software.com/support/topic/imunifyav-detected-malware/

• This reply was modified 2 years, 4 months ago by i_Mike.

Hi SJW,

As that post that i_Mike referenced, most likely these are false positives, however, the best way to start to check this is to verify the checksums. We can see these in your System info from the support tab. Can you post that via pastebin.com or submit a request to https://ewww.io/contact-us/ with the info attached?

Hi,
Same here, imunifyAV in cPanel
/wp-content/plugins/ewww-image-optimizer/binaries/gifsicle-fbsd
/wp-content/plugins/ewww-image-optimizer/gifsicle-linux
/wp-content/plugins/ewww-image-optimizer/optipng-fbsd
/wp-content/plugins/ewww-image-optimizer/pngquant-fbsd
/wp-content/plugins/ewww-image-optimizer/pngquant-linux
Reason: php_malware.id_SMW-HEUR-ELF

Hi adamewww

That’s the files that imunifyAV detected:
https://drive.google.com/file/d/1pw9Yp9XWXY4UycIPzlm8jve-FlrGc3N8/view?usp=sharing

Thank you

For folks having issues with this, someone provided us checksums that we could verify were valid (and obviously not malware). You can verify checksums here: https://github.com/nosilver4u/ewww-image-optimizer/blob/6560d3c95d716e296b37869532d831f75aca8e7f/unique.php#L1110

The email was rejected as Spam so I will provide the response here as well: `The checksums look to be valid versions of the public tools installed. If you wanted to, you could delete the plugin and the files in wp-content/ewww (though normally those get deleted when you delete the plugin), then reinstall the plugin from www.ads-software.com https://www.ads-software.com/plugins/ewww-image-optimizer/
If you still get alerts, then those are false positives. Considering this is a free AV software, that’s not terribly surprising. We did contact their support however their official submission process requires having ImmunifyAV installed as per: https://cloudlinux.zendesk.com/hc/en-us/articles/360011906013-How-to-submit-a-false-positive-negative-result-for-malware-scanner-`

@adamewww Thanks.

What about /wp-content/ewww/gifsicle – this file is outside the ewww plugin directory and is not included in the install file but the dir ewww appears to indicate it’s a related file.

I would probably say it’s the same, however, I would make sure to delete it when you delete everything else and re-install.

Probably? You don’t know if the file is a part of the ewww plugin?

Those tools can be installed independently. They are not our tools, but are free public tools that are available for anyone to use. https://www.lcdf.org/gifsicle/

So it’s entirely possible that it could have been installed by something else or manually, hence why I say probably. That having been said, given the fact that they are in the ewww folder, then yes our plugin installed them, and yes, you can delete it. The point is to delete everything and try reinstalling everything.