Sites infected with old SP Builder - Forum | JoomShaper
Staff replied SP Page Builder

Sites infected with old SP Builder

Asked by Alvaro Fernandez 2 months ago Last activity 2 months ago

Hi,

I have Agency version and used SP Page Builder in all the sites.
All have been compromised.

Two sites I have not been able to restart.
One is giving me database error trying to go to Admin.
the other blank page.

I deleted Rouge users.

I was given SPPB Scanner and scanned the sites and I have more than 4000 files warning.

Malaware: jsapi.whiteshop.icu

I've updated to 6.1.2 in most sites.
Except for two which I need help to restart.

How do we get rid of the hack?

Urgent please.

Thanks

5 replies

Oldest first Newest first Most helpful
Toufiq Senior Staff
2 months ago

Hi there,

Thank you for reaching out, and I apologize for any inconvenience caused by this oversight. To better address the issue, could you kindly provide Joomla administrator access? This will enable me to thoroughly investigate the matter and provide you with a prompt resolution.

I appreciate your cooperation and will ensure to get back to you as soon as possible.

Best regards,

Toufiqur Rahman (Team Lead, Support)

Alvaro Fernandez Asked this
2 months ago

Hi, Toufiqur Rahman, how are you?

Thanks for your help in advance.

See below.

Toufiq Senior Staff
2 months ago

Please disable Multi-factor Authentication.

Alvaro Fernandez Asked this
2 months ago

Hi Toufiq
thanks for your help.
Disabled.
Thanks

Toufiq Senior Staff
2 months ago

Do you have backup of this site?

Toufiq Senior Staff
2 months ago

Can't login

Toufiq Senior Staff
2 months ago

Please provide me FTP access of this site.

Paul Frankowski Senior Staff
2 months ago · edited

Hola Alvaro.

I have simple questions:

  1. Are all those sites are on the same server?
  2. Do you have sites separation? (ask hosting support if you are not sure)
  3. Did you installed any firewall on those sites? Real, a working one!

If yes (1 and 2), even if we or you clean one site, others (still "ill") may still infect it after a hours or day. Sorry, but it may work like that! I seen it.

In your case, it's better & faster to ask HOSTING support to recover sites from backup, for example, 5 days old. Then update all of them, scan and secure as much as possible. On all sites (J3-J6) TODAY install a free firewall component: https://htprotect.org/en/#htprotect - it has also has scanner, can clean sites and can protect sites. Use features from it.

We cannot fix or clean all your sites. For example, if even you can't log in to the site, how can we? That's why I mentioned about using backup. And I hope you know and understand that you're using Joomla 3.x sites on your own risk only! Yes, I know it's a painful truth.

Alvaro Fernandez Asked this
2 months ago

Hi Paul.

  1. A2vuelapluma is in Dreamhost by itself.
  2. The others are in Gatorhost, and all are together inside OTSLA.
    So yes probably infection can spread how can we avoid this and kill it right away.
    Thanks
    Alvaro
Log in to reply.