CLAMAV found malware

Could be false postive, but can you re-download the zip-file from https://downloads.www.ads-software.com/plugin/autoptimize.3.0.4.zip and overwrite your installation Mark?

frank

did some more searching, apparently there is a vulnerability in a specific PHP-version (5.3.6, which is ancient and should not be used anymore) when using ZipArchive with the addGlob method which indeed is used in autoptimizeCriticalCSSAjaxSettings.php. taking into account that (a) we need addGlob there and (b) the addGlob logic is only used for logged in administrators and (c) the vulnerability only exists in a very old version of PHP I would conclude this is a false positive in ClamAV which can safely be ignored ??

hope this clarifies, enjoy your weekend!
frank

my previous post with details is held for moderator approval, but confirmed to be a false positive ??