VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.29k stars 1.45k forks source link

YARA keeps deleting this file and making everyone's life harder #1954

Closed MKDan closed 1 year ago

MKDan commented 1 year ago

text/x-generic qa-base.php ( PHP script text ) <?php /* Question2Answer by Gideon Greenspan and contributors http://www.question2answer.org/

Description: Sets up Q2A environment, plus many globally useful functions

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

More about this license: http://www.question2answer.org/license.php

*/

define('QA_VERSION', '1.8.3'); // also used as suffix for .js and .css requests define('QA_BUILD_DATE', '2019-01-12');

/**

// Execution section of this file - remainder contains function definitions

qa_initialize_php(); qa_initialize_constants_1();

if (defined('QA_WORDPRESS_LOAD_FILE')) { // if relevant, load WordPress integration in global scope require_once QA_WORDPRESS_LOAD_FILE; } elseif (defined('QA_JOOMLA_LOAD_FILE')) { // if relevant, load Joomla JConfig class into global scope require_once QA_JOOMLA_LOAD_FILE; }

qa_initialize_constants_2(); qa_initialize_modularity(); qa_register_core_modules();

qa_initialize_predb_plugins(); require_once QA_INCLUDE_DIR . 'qa-db.php'; qa_db_allow_connect();

// $qa_autoconnect defaults to true so that optional plugins will load for external code. Q2A core // code sets $qa_autoconnect to false so that we can use custom fail handlers. if (!isset($qa_autoconnect) || $qa_autoconnect !== false) { qa_db_connect('qa_page_db_fail_handler'); qa_initialize_postdb_plugins(); }

// Version comparison functions

/**

/**

/**

// Initialization functions called above

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

// Functions for registering different varieties of Q2A modularity

/**

/**

/**

/**

// Function for registering varieties of Q2A modularity, which are (only) called from qa-plugin.php files

/**

/**

/**

/**

// Low-level functions used throughout Q2A

/**

/**

/**

/**

/**

/**

// Functions for listing, loading and getting info on modules

/**

/**

/**

/**

/**

/**

/**

// HTML and Javascript escaping and sanitization

/**

/**

/**

/**

/**

// Finding out more about the current request

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

// Language phrase support

/**

/**

/**

/**

/**

// Request and path generation

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

/**

// General utilities

/**

/**

/**

// Event and process stage reporting

/**

/**

function qa_report_process_stage($method) // can have extra params { global $qa_process_reports_suspended;

if (@$qa_process_reports_suspended)
    return;

$qa_process_reports_suspended = true; // prevent loop, e.g. because of an error

$args = func_get_args();
$args = array_slice($args, 1);

$processmodules = qa_load_modules_with('process', $method);
foreach ($processmodules as $processmodule) {
    call_user_func_array(array($processmodule, $method), $args);
}

$qa_process_reports_suspended = null;

}

plusvic commented 1 year ago

YARA itself doesn't delete files. Perhaps you are using some tool that uses YARA for detecting and deleting files? In that case that's an issue with that tool or any YARA signature provided by that tool.