cadline_web/malware_remediation
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(store): remove 281 legit false-positives (EOL + com_users version) #1

Merged
imre merged 1 commits from store-cleanup-fp into main 2026-07-19 15:03:20 +02:00
Conversation 0 Commits 1 Files Changed 563 +295 -123803
imre.agent commented 2026-07-19 13:44:20 +02:00
Owner
Copy Link

Store cleanup: 281 legit false-positives removed

The HIDS quarantine misclassified 281 legit files as malware. This PR removes
them (562 objects = content + .evidence.json sidecar). The real malware stays:
729 droppers + the injections (event.php, joomla.php auth-backdoor, storage.php
loader, helix3 seo-cloaking).

Evidence

  • 251 EOL-only: the live docroot was CRLF, the baseline LF (old Windows/FTP
    deploy artifact). diff --strip-trailing-cr = 0 bytes → byte-identical modulo
    line endings. Zero content difference.
  • 30 com_users (archlinexp.eu): Joomla 2018→2019 point-release drift
    (copyright + a Referrer-Policy security header). 0 malware markers in the
    added lines — verified per file.

Safety: 0 paths outside archline/eu maintenance / modules / com_users /
common_cadline_libraries. Fully revertable (git revert).

Audit trail: audit/store-cleanup-2026-07-19.md. Root cause: the baseline-diff was
byte-exact against an LF/older-version baseline; fix tracked in illusion/hids#128 +
illusion3-salt#894.

## Store cleanup: 281 legit false-positives removed The HIDS quarantine misclassified **281 legit files** as malware. This PR removes them (562 objects = content + `.evidence.json` sidecar). The real malware stays: **729 droppers** + the injections (event.php, joomla.php auth-backdoor, storage.php loader, helix3 seo-cloaking). ### Evidence - **251 EOL-only**: the live docroot was CRLF, the baseline LF (old Windows/FTP deploy artifact). `diff --strip-trailing-cr` = **0 bytes** → byte-identical modulo line endings. Zero content difference. - **30 com_users (archlinexp.eu)**: Joomla **2018→2019** point-release drift (copyright + a `Referrer-Policy` security header). **0 malware markers** in the added lines — verified per file. Safety: 0 paths outside archline/eu `maintenance` / `modules` / `com_users` / `common_cadline_libraries`. **Fully revertable** (`git revert`). Audit trail: `audit/store-cleanup-2026-07-19.md`. Root cause: the baseline-diff was byte-exact against an LF/older-version baseline; fix tracked in illusion/hids#128 + illusion3-salt#894.
imre.agent added 1 commit 2026-07-19 13:44:20 +02:00 
The remediation store held 281 legit files misclassified as malware:
- 251 EOL-only: live docroot CRLF vs baseline LF (old deploy artifact);
  strip-trailing-cr diff = 0 (byte-identical modulo line endings).
- 30 com_users (archlinexp.eu): Joomla 2018->2019 point-release drift
  (copyright + Referrer-Policy header), 0 malware markers.
The 729 droppers + real injections (event/joomla/storage/helix3) remain.
Audit: audit/store-cleanup-2026-07-19.md. Fully revertable.

Assisted-by: claude-code@claude-opus-4-8
imre merged commit 68a81d0f18 into main 2026-07-19 15:03:20 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: cadline_web/malware_remediation#1
No description provided.
Delete Branch "store-cleanup-fp"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?