InfiniteWP client plugin getting false positives

Are you scanning with high sensitivity enabled?

tim

ah, that explains it, yes, I am the one who reported this to infinitewp and yes, I had “high sensitivity” checked.

I know its a false positive, I had just thought to warn them in case other users experienced teh same.

Ok, if it only shows up during high-sensitivity scanning, that is expected. Usually this option is only used to help in cleaning difficult infections, and we generally recommend leaving it off, since false positives will be found in files that are ok.

More details on the high sensitivity option are included here:
High Sensitivity Scanning

Thanks for the clarification!

I received the same notification but High Sensitivity Scanning was not enabled. Should I be concerned?

Was it the same exact message, including “wp-content/plugins/iwp-client/” as the path to the file?

A similar message might also come up on the pclzip file included with WordPress itself, if you have a second copy of WordPress installed in the same folder. (For example, a regular WordPress site, plus another copy of WordPress installed at site.com/blog/ or a similar location.)

It is probably ok, but if you want to email me a copy of the file at mattr [at] wordfence.com then I can take a quick look. Please include a link to this post in the message.

montanagrafix:

I received your files — the zip file and .tmp file are most likely ok. We have seen this from other backup plugins because some of the files that are known to be safe can’t be verified in the same way while inside a backup file, but this is the first time I have seen it in backups from InfiniteWP. Are you using the Wordfence Option “Scan image files as if they were executable”?

If the zip can be opened like a normal zip file, then it is most likely fine. The tmp file is probably a partial zip file that was made during the backup, and might already be gone.