Malware scanner: handling false positives and quarantine

Why a structured method matters

Malware scanners are essential but not infallible. False positives happen: legitimate system changes, customized plugins or similar signatures. Without a clear method you risk deleting needed files or restoring infected ones. The following decision flow helps agencies manage alerts on WordPress, WooCommerce and PrestaShop.

Decision steps

1. Initial severity

• Record the scanner's severity (low, medium, high). High severity needs immediate attention; low can be scheduled for verification.

2. File fingerprint

• Compute and record the file's SHA256. Search for the same fingerprint in official sources (plugin/theme repositories, official GitHub releases) to confirm whether it’s a known file.

3. File origin

• Check the path: files under wp-content/plugins/plugin-name/ are expected, while stray PHP files in wp-includes/ are suspicious. For WooCommerce, check if the flagged file relates to payments or webhooks.

4. Compare with official source

• Download the official package and compare files (diff/sha256). Small, explainable differences (translations, timestamps) often indicate a false positive.

5. Verify legitimate changes

• Review deployment history and commits. Recent updates or developer customizations can explain discrepancies.

6. Backup before action

• Make a full backup (files + DB) before deleting or restoring. Test restoration in staging.

7. Reversible quarantine

• Quarantine the file (move to isolated folder, deactivate plugin) instead of permanent deletion. Log date, fingerprint and reason.

8. Highly targeted allowlisting

• If the file is needed for critical functionality (payments, sync), apply minimal allowlisting: restrict access by IP, disable certain features, or deploy WAF rules temporarily.

9. Re-scan and monitor

• Re-scan after quarantine and after restoring from official source. Enable file-integrity monitoring and log monitoring for at least 72 hours.

10. Document and communicate

• Save evidence (hashes, diffs, log excerpts) and document actions. Advise the client or team of residual risk and next steps.

Platform-specific notes

• WordPress: compare against WordPress.org and vendor packages. Be cautious with paid plugin customizations.

• WooCommerce: prioritize checks on payment hooks, gateways and webhook handlers; run test payments on staging after changes.

• PrestaShop 1.7–9: check /override/ and third-party modules. Modules often include server-side executables—compare with official module packages.

Practical checklist

• Record severity and save the alert

• Compute and store SHA256

• Compare with official source

• Check deployment history

• Backup fully before action

• Quarantine instead of delete

• Apply targeted allowlisting if needed

• Re-scan and monitor 72+ hours

• Document and inform stakeholders

When to call professionals

If the alert involves sensitive data, a live production incident, or indicators of compromise (unknown users, outbound connections to suspicious IPs), engage a specialist. Forensic analysis ensures a proportionate and correct response.

Conclusion

A reversible quarantine and a clear decision process minimize mistakes. Prioritize backups, fingerprint checks, least-privilege allowlisting and monitoring. Tools for file-integrity and documented procedures help agencies protect WordPress, WooCommerce and PrestaShop without disrupting business operations. Securantis can assist agencies to formalize these workflows while noting that no solution guarantees absolute security.