maldet detecting BOOTX64.efi as Broken Executable

General support questions
Post Reply
pizzazforall
Posts: 1
Joined: 2019/02/06 16:22:37

maldet detecting BOOTX64.efi as Broken Executable

Post by pizzazforall » 2019/02/06 16:26:51

I am getting the following detection from maldet today, the same file was pulled from two different mirrors and was detected the same

HOST: abc123.abc.123.xyz
SCAN ID: 190206-0952.89725
STARTED: Feb 6 2019 09:52:30 -0600
COMPLETED: Feb 6 2019 09:52:31 -0600
ELAPSED: 1s [find: 0s]

PATH: /var/www/html/mirror/centos/6/os/x86_64/EFI/
TOTAL FILES: 6
TOTAL HITS: 1
TOTAL CLEANED: 0

FILE HIT LIST:
{CAV}Heuristics.Broken.Executable : /var/www/html/mirror/centos/6/os/x86_64/EFI/BOOT/BOOTX64.efi => /usr/local/maldetect/quarantine/BOOTX64.efi.2835728230
===============================================
Linux Malware Detect v1.6.3 < proj@rfxn.com >

User avatar
TrevorH
Site Admin
Posts: 33218
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: maldet detecting BOOTX64.efi as Broken Executable

Post by TrevorH » 2019/02/06 16:33:32

Sounds like something that needs to be reported to the maldet authors as a false positive to me.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

Post Reply