Support

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: (2.5.9)
PHP version: (5.3)
MySQL version: (unknown)
Host: (arvixe)
Admin Tools version: (2.5.2)

Description of my issue:

In the Configuration window there are a number of options.  I have read through the docs and they seem to indicate that php is selected by default.  Perhaps the docs are old because when I scan it shows nothing (Total Files - 0, Modified - 0, Possible Threats - 0 Added - 0, Ne Reports Generated).  I have since added 'php' in the dialog box for 'Files types to be scanned' and it added 3000 files and flagged 110 files as possible threats. If it's never actually scanned anything before I'm not sure how it flagged 110 docs, a majority of which were akkeba components.  This is also a relatively new joomla install that has been running Admin Tools.

The second time I ran the scan it reported 110 files as modified as as a possible threat.

In the Basic Configurations I have - Files types to be scanned - 'php' (I added 'php')

Excluded folder not be to scanned - empty

Excluded files not to be scanned - empty

Min Exe time - 0

Max exe time - 1

runtime bias - 75

Is this the typical configuration or should I add anything else?

I have attached my reports for you to review.

Thank You,

Kurt

I have read through

https://www.akeebabackup.com/documentation/admin-tools/php-file-scanner.html

and understand the scoring.  I guess my questions were, do I need to add 'php' to the configurations because by default it was not there and by default it does not scan php files.  The documentation seems to indicate this is done by default so it confused me as what was the correct procedure.

The other item that is confusing is the report of changed files.  The documentation says

When a file change is detected. A file change is detected only if the file is added or modified since the immediately previous scan. This means that if you scan now, modify a PHP file and scan again, it will show up as modified. If you perform a third scan right after the second one, the file will NOT be reported as changed. This is normal! The file was changed between the first and second scan, but not between the second and third scan.

If I am reading this correctly it would indicate that the 110 flagged files would know longer be flagged once I run the scan again because it would be comparing the previous scan but I have run additional scans and those same 110 files still come up as Modified.