After The Latest Update Or Sp Page Builder Again Viruses - Question | JoomShaper
Back to the questions

After The Latest Update Or Sp Page Builder Again Viruses

I

Ionut

SP Page Builder 1 week ago

Guys, if SP Page Builder is not safe anymore just tell us. I keep it all my website safe until your latest update.. after this update in few hours i have viruses EXT_WEBSHELL_PHP_Generic pack: Neo23x0 signature-base • rule file: external/neo23x0-signature-base/gen_webshells.yar

0
9 Answers
Order by
Oldest Newest Votes
Paul Frankowski
Paul Frankowski
Accepted Answer
Senior Staff 1 week ago #230332

Hi Ionut,

It means that:

  1. You didn't clean your server deeply, one hidden file might left and wait for activation.
  2. You may have different extension that may "hole".
  3. You don't have firewall installed that block popular hacker's request.

This is NOT always only our fault, common. I have 20 websites on last SPPB with firewall, they are very popular and still clean from malware/viruses, why?

0
I
Ionut
Accepted Answer
1 week ago #230339

i did all of these.

until last night nothing for 3 weeks. after updating in3 4 hours Igotthese

0
MiBa
MiBa
Accepted Answer
1 week ago #230348

You can check the logs for known markers to determine whether it’s an SPPB or Helix Ultimate issue. See if either of these endpoints returns a 200 response:

  • /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
  • /index.php?option=com_ajax&plugin=helixultimate&format=json&task=saveMegaMenuSettings

As Paul said - a firewall is mandatory—it will save you and support a lot of time.

0
Paul Frankowski
Paul Frankowski
Accepted Answer
Senior Staff 1 week ago #230341

New version (6.7.1) is even more secured compare to previous ones (6.x).

  1. Do you have firewall component installed? If not, why not?! If yes, which one?
  2. Where malware files are located, in which subfolder?

very important questions for Us! please respond

0
I
Ionut
Accepted Answer
1 week ago #230349

Hi,

  1. Please check your editor from mobile, it's strange, is cut the space and double the text wrote.
  2. Yes, i have my own centre of protection with scan malware, protection with ini and htacees an many more.
  3. It was safe until last night after the update.. i don't know. i'm checking
  4. virtuemart folder with files vm are adeed in the root of the website, this is new. i never had virtuemart...
  5. success true message null messages null data []
  6. your 1link for my is forbidden from my protection.
0
MiBa
MiBa
Accepted Answer
1 week ago #230372
  1. {"success":false,"message":null,"messages":null,"data":{"message":"You require admin access to use this application."}}
0
Paul Frankowski
Paul Frankowski
Accepted Answer
Senior Staff 1 week ago #230363

ad 4) ??? This one never seen before. ??? maybe ask on forum.joomla.org and hosting provider how they were created (when, IP, etc)

ad 6) Read from phone browser.

thanks

0
V
Vic
Accepted Answer
1 week ago #230379

@Paul Frankowski

Paul, tell me. Will there be a patch for those who can't install the new version of the SPPB (6.7.1) yet? How about, I have Joomla 4.4.14 and SPPB 5.X, patched in June (file replacement asset.php). Thanks

0
M
Mario
Accepted Answer
1 week ago #230383

@Paul Frankowski Personal question: What firewall component do you use and can recommend to us joomla users?

0