webbie07 Hey everyone, just to give some context – also for @Sven
All the files mentioned are local backup files in the auto-update folder. HTProtect backs up the affected files before every update so that if something goes wrong, the update can be fully rolled back. registry.json is a directory of installed extensions, cas/… is the backup storage – copies of your own files stored under their checksum.
The fact that a scanner can flag these files is just how security tools work: HTProtect detects malware based on patterns (signatures, WAF rules) – a backup copy of these detection files will inevitably contain those patterns and get flagged as "suspected." What’s actually detected is the detection logic itself, not malware. This is normal across security tools: Imunify360, for example, has deleted the mysites.guru connector multiple times this year, and I’ve spent days dealing with false positives from HTProtect with Imunify.
The "suspected" label comes from mysites.guru, not HTProtect – I have no control over their heuristics. The fastest way to move forward is to contact mysites.guru with the file paths and report the false positive so they can improve their detection.
I’m continuously working on reducing the surface for these false positives – starting with version 2.5.2, registry.json will be stored compressed and cleaned up. I also suggested an account-based exclusion path to mysites.guru but haven’t heard back yet.
You can Changelog follow the changes in new versions.
Cheers, Pascal