Support

Akeeba Backup for Joomla!

#42768 Norton Blocked download Akeeba backup: PHP:BackDoor-EP [Trj]

Posted in ‘Akeeba Backup for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
5.4.3
PHP version
8.4
Akeeba Backup version
10.3.0

Latest post by nicholas on Wednesday, 04 March 2026 05:03 CST

wens2021

____________________________

Details

Threat Name: PHP:BackDoor-EP [Trj]
Threat Type: Trojan Horse - This threat pretends to be something else (e.g., an image, document, or other file) to trick you into executing it and thus infecting your computer.

Status: Cancelled
Detected by: Safe Web
____________________________

Source

Downloaded from: https://www.akeeba.com/download/akeeba-backup/10-3-0/pkg-akeebabackup-10-3-0-pro-zip.raw|>com_akeebabackup-pro.zip|>backend\vendor\akeeba\engine\engine\Dump\Native\Postgresql.php
____________________________

Activity

Path | Type | Status

https://www.akeeba.com/download/akeeba-backup/10-3-0/pkg-akeebabackup-10-3-0-pro-zip.raw|>com_akeebabackup-pro.zip|>backend\vendor\akeeba\engine\engine\Dump\Native\Postgresql.php | URL | Blocked

nicholas
Akeeba Staff
Manager

This is a false positive. We cannot do anything about broken third party antivirus software misidentifying legitimate software.

You can of course inspect the file yourself. You will see that it's the PostgreSQL database backup engine, added in 10.3.0. The broken antivirus is throwing a false positive because we have to run PostgreSQL's database dump (pgdump) binary to export its structure. Despite what the idiots who wrote the signature think (or, rather, don't think) there are FAR MORE legitimate uses for doing so than the single instance they found in a very old piece of malware from a decade ago.

Look. I can very easily obfuscate what the file is doing which –ironically– is what an actual malware author would be doing. Then, they would not be able to misidentify the software. If Norton (or, rather, whoever owns that brand these days) can't get their head out of their ass I will have to. The file will become unreadable to other people and look like legitimate malware even though it's not, but the idiotic antivirus won't be misidentifying it. The irony of this is not lost on me – and it's something I have already done in Admin Tools, since its signatures for detecting malicious code patterns were throwing false positives on other code scanners.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!