search

nexylan / PHPAV

PHP CLI Virus/Malware Scanner
MIT License
26 stars 7 forks source link

PHPAV problem when scanning files starting with $GLOBALS #1

Closed Kliklaklut closed 8 years ago

Kliklaklut commented 9 years ago

Hi,

I got a problem while running this scan on nx1209 : 

user@server ~ $ sudo php /root/PHPAV/scan.php /var/www

It prompted me the following : 

Scanning /var/www for potential obfuscated malware...

Infected file (reason : First-line file with eval) :
    /var/www/site/.../example.php
Infected file (reason : First-line file with eval) :
    /var/www/site/example.php

And kept being stucked there.

After deeper analysis we found out the file was starting with 

<?php

$GLOBALS['_scb_data'] = array( 42, __FILE__, array(

and that may be the issue.

Regards, Sébastien

gallart commented 8 years ago

Could not reproduce.