Support

Hi
Siteground's malware scanner detected 'suspicious code' in a GeoIP file composer.phar . They have gone on to say it is BASE64 code (means nothing to me, I think).

The coding contains many characters that are question marks in a black diamond, at the top and at the bottom of the page. Research suggests it is to do with encoding, and if I change from MacOSX 'default" to (forget offhand but think changing the browser setting to Western Mac OS Roman or possibly UTF-8) the question marks contain other 'normal' characters, but still seemingly random.

The file date is the same as the original install.

If this sounds like the incomplete installation situation that is described in Admin Tools documentaion for AKGeoIP, the self-check feature, then I will just re-install on top and see what happens.

If not, then can you please suggest what to do?

The file path is plugins/system/akgeoip/lib/composer.phar

The strange code starts

_ HALT _ COMPILER ( ) ; ?>
?oX
composer . pharsrc / bootstrap . php?K??S???2??src / Composer....... [followed by 30 or so lines of similar]

and ends

d | ??? | ?
??? B ? GBMB

please note that question marks are white in a black diamond and I have added some extra character spaces just in case (just to be safe).

Thanks for any suggestions on what to do.
Robin

Thanks for your fast reply Nicholas. Sorry if I misled, I hadn't thought the composer file itself was malware, or Composer, which I researched first (and got a little understanding of its use/status).

What I was unsure of was if the code including question marks was inserted mal-code - inserted during or since download, or as it should be. Somewhere in your excellent documentation you suggest malware often is inserted at the start and end of (php) files, the pattern I saw here.

I also am a little unsure with your comment that the file was added to the download package in error, in case it was my error. Or if you are saying (which I think most likely), all is fine and nothing to worry about.

As I am familiar with html and css hopefully a time will come that I start to understand other file types and potential good/bad coding. Until then, sorry, I feel it necessary to ask!

Thanks again
Robin

OK thanks for that reassurance Nicholas!