After updating one of the signature files (ver. 198) last week, I have been receiving several alarms for PHP injection coming from my site and out to Google and other addresses. None are inbound as I am not running PHP on any of our servers and they have all been patched. I've followed up on the machines in question and found them to be needing an update to the latest windows patches. They have all had updated antivirus signatures. The last straw was when my machine was flagged and I am meticulous about applying patches and anti-spyware scanning. Is there anyone else running into this? Is it a false positive?
Regards,
Mark
