{"action":"created","issue":{"url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/50","labels_url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/50/comments","events_url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/50/events","html_url":"https://github.com/rfxn/linux-malware-detect/issues/50","id":73526916,"number":50,"title":"Maldet monitoring not picking up malware","user":{"login":"nisamudeen97","id":12267398,"avatar_url":"https://avatars.githubusercontent.com/u/12267398?v=3","gravatar_id":"","url":"https://api.github.com/users/nisamudeen97","html_url":"https://github.com/nisamudeen97","followers_url":"https://api.github.com/users/nisamudeen97/followers","following_url":"https://api.github.com/users/nisamudeen97/following{/other_user}","gists_url":"https://api.github.com/users/nisamudeen97/gists{/gist_id}","starred_url":"https://api.github.com/users/nisamudeen97/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nisamudeen97/subscriptions","organizations_url":"https://api.github.com/users/nisamudeen97/orgs","repos_url":"https://api.github.com/users/nisamudeen97/repos","events_url":"https://api.github.com/users/nisamudeen97/events{/privacy}","received_events_url":"https://api.github.com/users/nisamudeen97/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-06T06:11:57Z","updated_at":"2015-05-25T12:55:56Z","closed_at":null,"body":"Maldet iNotify Monitoring was unable to detect malicious files in realtime monitoring meanwhile manual scan detected the same files as malicious. But, why isn't the monitoring process picking up the malware? any ideas? Current maldet version I am using is 1.4.2 \r\n\r\n\r\nI setup the scanner to keep tabs on /home/username (all 6) and the monitoring process IS checking files being uploaded, created or modified, but on two occasions now, it has missed infected files being put on the server.\r\nRunning maldet -a /home/XXX manually and it picks up the infected files and quarantines them, as the monitoring process is supposed to do.\r\nThe log file shows the file being created/modified, but nothing about it picking up the malware.\r\n\r\ngrep -w 'backup/proxy.php' /usr/local/maldetect/inotify/inotify_log\r\n/home/username/public_html/newsite/wp-content/plugins/revslider/backup/proxy.php CREATE 27 Apr 14:44:52\r\n/home/username/public_html/newsite/wp-content/plugins/revslider/backup/proxy.php MODIFY 27 Apr 14:44:52\r\n/home/username/public_html/newsite/wp-content/plugins/revslider/backup/proxy.php MODIFY 27 Apr 14:44:52\r\n/home/username/public_html/newsite/wp-content/plugins/revslider/backup/proxy.php MODIFY 27 Apr 14:44:52\r\n/home/username/public_html/newsite/wp-content/plugins/revslider/backup/proxy.php MODIFY 27 Apr 14:44:52\r\n\r\nRunning a manual scan results in:\r\n\r\nmalware detect scan report for xxxxxxxxxxxx:\r\nSCAN ID: 042715-1505.3285\r\nTIME: Apr 27 15:07:41 +0100\r\nPATH: /home/username/public_html/\r\nTOTAL FILES: 37322\r\nTOTAL HITS: 2\r\nTOTAL CLEANED: 0\r\n\r\nFILE HIT LIST:\r\n{CAV}Php.Malware.Mailbot-1 : /home/username/public_html/xxxxxxxx/images/testimonials/css.php => /usr/local/maldetect/quarantine/css.php.8062\r\n{CAV}Php.Malware.Mailbot-1 : /home/username/public_html/newsite/wp-content/plugins/revslider/backup/proxy.php => /usr/local/maldetect/quarantine/proxy.php.3538\r\n\r\n But, why isn't the monitoring process picking up the malware? any ideas? \r\n\r\nCurrent maldet version I am using is 1.4.2 \r\n"},"comment":{"url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/comments/105228150","html_url":"https://github.com/rfxn/linux-malware-detect/issues/50#issuecomment-105228150","issue_url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/50","id":105228150,"user":{"login":"webwizardworks","id":11152684,"avatar_url":"https://avatars.githubusercontent.com/u/11152684?v=3","gravatar_id":"","url":"https://api.github.com/users/webwizardworks","html_url":"https://github.com/webwizardworks","followers_url":"https://api.github.com/users/webwizardworks/followers","following_url":"https://api.github.com/users/webwizardworks/following{/other_user}","gists_url":"https://api.github.com/users/webwizardworks/gists{/gist_id}","starred_url":"https://api.github.com/users/webwizardworks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/webwizardworks/subscriptions","organizations_url":"https://api.github.com/users/webwizardworks/orgs","repos_url":"https://api.github.com/users/webwizardworks/repos","events_url":"https://api.github.com/users/webwizardworks/events{/privacy}","received_events_url":"https://api.github.com/users/webwizardworks/received_events","type":"User","site_admin":false},"created_at":"2015-05-25T12:55:55Z","updated_at":"2015-05-25T12:55:55Z","body":"I have the same situation and am looking for the answer as well. It would seem that until I can get the inotify real time file scanning working dependably, I'd be better off running it manually on an hourly cron.\r\n\r\nAny insight into this would be greatly appreciated."}}