The hash file is built with the Publishing Suite in mind. So forum.php would be included but isn't needed in the Forum only package. The contents of index.php in the Publishing Suite are different as well. If those are the only two files, then you can ignore them as false positives for now.
Are your issues continuing to occur?
Comment