linux-malware-detect icon indicating copy to clipboard operation
linux-malware-detect copied to clipboard

Malware name not always logged to the quarantine history

Open Gazoo opened this issue 3 years ago • 0 comments

In my testing sometimes the malware name seems to missing from the /usr/local/maldetect/sess/quarantine.hist randomly.

To replicate:

Download the sample malware collection from below into a web directory and run a maldet scan on it then quarantine the detected malware:

https://github.com/marcocesarato/PHP-Malware-Collection/archive/refs/heads/master.zip

Then look inside the /usr/local/maldetect/sess/quarantine.hist and you will see that some malware names are empty ( just search for two colons :: )

It seems to be random as you can run multiple scans and sometimes different entries will be missing the malware name. quarantine.hist.txt

Gazoo avatar Jan 09 '22 13:01 Gazoo