Staff replied SP Page Builder

Viruses

Asked by Ionut 3 months ago Last activity 3 months ago

Hi,
Our all websites were virused throught sp page builder. we clean all of them, removed lines from htaccess, removed from cron and more.... 24h it was ok, no it's happen again, and we have the latest version.

And ideea? help?

8 replies

Paul Frankowski Senior Staff

3 months ago · edited

Hi,

Follow (many tips, suggestions, codes, tools) >> https://www.joomshaper.com/forum/question/45152

If you updated everything, you need:

Scan whole server. Then scan site using scanner (from github).
Install Firewall component.
Add extra code for .htaccess file
Check server logs, and block those IPs.

Ionut Asked this

3 months ago

Thaks, i did all.... now it's again ....

Mehtaz Afsana Borsha Staff

3 months ago

Hi,

Thanks for contcating us. You can also check this

https://github.com/zkrana/joomla-security-scanner

-Regards.

Paul Frankowski Senior Staff

3 months ago · edited

If you would have good firewall component hacker couldn't upload any malware file. It means that:

was hidden backdoor on your site files (with neutral extension name) or
was hidden it beyond public_html or
was hidden it inside database table.

Ionut Asked this

3 months ago

Thank you,
Can be also in databse?
because from what i see:

in htaccess rule
in tempaltes is generating tempaltes with tmp
in sp page builder is creating font with php
in folder images php files
in joomla root php files

Paul Frankowski Senior Staff

3 months ago · edited

Yes. Two users mentioned about that possibility in topic that I shared.

Maybe recover whole website from backup: 5 or 10 days old before The D-Day.

If you made any big content changes in last 72h, you can keep only SPPB table from it, and whole rest should be taken from "the past".

Paul Frankowski Senior Staff

3 months ago · edited

This is screenshot from firewall (today) they are still trying but their IP is locked each time. And since 15 June, no infections anymore.

my settings

Ionut Asked this

3 months ago

It's enought to have this in htaccess?

    ##
    # Emergency block - SP Page Builder uploadCustomIcon exploit
    # Blochează requesturile către:
    # index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
    ##
    RewriteCond %{QUERY_STRING} (^|&)option=com_sppagebuilder(&|$) [NC]
    RewriteCond %{QUERY_STRING} (^|&)task=(asset\.uploadCustomIcon|asset%2euploadCustomIcon)(&|$) [NC]
    RewriteRule ^ - [F,L]

In databases what i find is new users created, so is creating new users and from here will create new rules...

Paul Frankowski Senior Staff

3 months ago

That's not quite enough; it's definitely worth adding additional rules in .htaccess to the /images, /media, and /file folders as well—as we mentioned in the thread mentioned earlier — to protect them from unauthorized .php files.