Admin Tools

#24431 composer.phar scanned as infected file

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by BigStef on Friday, 12 February 2016 14:48 CST

Thursday, 11 February 2016 14:05 CST

BigStef

Hi Akeeba team,
I have trouble with email sent to AOL, my Ip is classed with a very poor reputation. I'm trying to resolve this with the help of SiteGround Support. Before requesting a de-list for the IP, they have scanned all my websites.
SiteGround scanner has detected the composer.phar as an infected file on all my website. I have read topic "#22673 – akgeoip code error" where Nicholas said that it is not an infected file. He also said that it was embedded in the instal package by error. Can I erase that file from plugins/system/akgeoip/lib/ on all sites ? Or should I let in and tell SiteGround that it is just not an infected file ?
BTW, all "/log/admintools_breaches.log" are also scanned as infected files. I opened them but didn't find anything wrong with them...
What can I say to SiteGround ? Thanks in advance...

Stephan Herby PAO Production New Caledonia - Canada - France

Friday, 12 February 2016 01:50 CST

tampe125

Hello Stephan,

compose.phar detection is a false positive. Composer is a very well known program used to manage dependencies, so most likely the file got flagged since it's a compressed archive containing PHP code.
However, you can safely remove that, since it's only used inside the development area to update all libraries.
Regarding the log file, it's excepted to contain malware code: we are blocking the attacks performed on your site and log the request to such file. Anyway, you don't have to worry, since the file is not executable in any way.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Friday, 12 February 2016 14:48 CST

BigStef

Hi Davide,
This was what I was expecting. I can send your answer to SiteGround so we can now ask for a de-listing at AOL.
Nice you had a minute for answering this topic, thank you!