Malware Detected in classes/Tools.php

[nbarnum]

On line 2751 my malware software flagged this as a security risk:

    public static function str_replace_once($needle, $replace, $haystack)
    {
        $pos = false;
        if ($needle) {
            $pos = strpos($haystack, $needle);
        }
        if ($pos === false) {
            return $haystack;
        }
        return substr_replace($haystack, $replace, $pos, strlen($needle));
    }

We suspected a module or something was corrupted and someone was able to add that to our site.  I downloaded 1.6.1.4 from Prestashop and I see that exact same code is there as well.  What is this code and is it a security risk?

[sandya]

I just had the exact same situation !!!  I am using Sitelock through GoDaddy and they flagged this string in Classes/Tools as malicious - can anyone help us on this ? I am running on PS 1.6.1.3.

[bellini13]

we call these things false positives.  It is not malicous, the code looks for the first instance of "needle", and replaces that value with a new value.