I have been using maldet for many months and it's worked fine up until now. As of about a week ago, it is detecting a mass {HEX}PHP.Bypassshell in nearly every PHP file. I even downloaded a clean copy of Joomla 3 and it still detected that within the PHP files.Any thoughts on what the problem could be? Sample results:malware detect scan report for xxxxxxxx: SCAN ID: 072513-1957.12823  TIME: Jul 25 19:58:04 -0400 PATH: /home/xxxxx/public_html/testnew/  TOTAL FILES: 5549 TOTAL HITS: 361 TOTAL CLEANED: 0NOTE: quarantine is disabled! set quar_hits=1 in conf.maldet or to  quarantine results run: maldet -q 072513-1957.12823 FILE HIT LIST:  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/administrator/templates/hathor/html/com_categories/categories/default.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/administrator/templates/hathor/html/com_menus/items/default.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/administrator/templates/hathor/html/layouts/joomla/edit/details.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/administrator/components/com_cache/models/cache.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/administrator/components/com_cache/controller.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/administrator/components/com_content/models/article.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/administrator/components/com_content/models/fields/modal/article.php  .......... {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/form/field.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/form/fields/color.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/form/fields/checkbox.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/form/fields/databaseconnection.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/form/fields/note.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/form/rule.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/oauth1/client.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/session/storage.php  {HEX}PHP.Bypassshell :  /home/xxxxxx/public_html/testnew/libraries/joomla/profiler/profiler.php  ..........
maldet and possible false positives?
security;malware