After the latest update or Sp Page Builder again viruses - Forum | JoomShaper
Awaiting an answer SP Page Builder

After the latest update or Sp Page Builder again viruses

Asked by Ionut 2 months ago Last activity 2 months ago

Guys, if SP Page Builder is not safe anymore just tell us. I keep it all my website safe until your latest update.. after this update in few hours i have viruses
EXT_WEBSHELL_PHP_Generic
pack: Neo23x0 signature-base • rule file: external/neo23x0-signature-base/gen_webshells.yar

7 replies

Oldest first Newest first Most helpful
Paul Frankowski Senior Staff
2 months ago · edited

Hi Ionut,

It means that:

  1. You didn't clean your server deeply, one hidden file might left and wait for activation.
  2. You may have different extension that may "hole".
  3. You don't have firewall installed that block popular hacker's request.

This is NOT always only our fault, common. I have 20 websites on last SPPB with firewall, they are very popular and still clean from malware/viruses, why?

Ionut Asked this
2 months ago

i did all of these.

until last night nothing for 3 weeks. after updating in3 4 hours Igotthese

MiBa
2 months ago

You can check the logs for known markers to determine whether it’s an SPPB or Helix Ultimate issue. See if either of these endpoints returns a 200 response:

  • /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
  • /index.php?option=com_ajax&plugin=helixultimate&format=json&task=saveMegaMenuSettings

As Paul said - a firewall is mandatory—it will save you and support a lot of time.

Paul Frankowski Senior Staff
2 months ago · edited

New version (6.7.1) is even more secured compare to previous ones (6.x).

  1. Do you have firewall component installed? If not, why not?! If yes, which one?
  2. Where malware files are located, in which subfolder?

very important questions for Us! please respond

Ionut Asked this
2 months ago

Hi,

  1. Please check your editor from mobile, it's strange, is cut the space and double the text wrote.
  2. Yes, i have my own centre of protection with scan malware, protection with ini and htacees an many more.
  3. It was safe until last night after the update.. i don't know. i'm checking
  4. virtuemart folder with files vm are adeed in the root of the website, this is new. i never had virtuemart...
  5. success true
    message null
    messages null
    data []
  6. your 1link for my is forbidden from my protection.
MiBa
2 months ago
  1. {"success":false,"message":null,"messages":null,"data":{"message":"You require admin access to use this application."}}
Paul Frankowski Senior Staff
2 months ago · edited

ad 4) ??? This one never seen before. ??? maybe ask on forum.joomla.org and hosting provider how they were created (when, IP, etc)

ad 6) Read from phone browser.

thanks

Vic
2 months ago · edited

@Paul Frankowski

Paul, tell me.
Will there be a patch for those who can't install the new version of the SPPB (6.7.1) yet?
How about, I have Joomla 4.4.14 and SPPB 5.X, patched in June (file replacement asset.php). Thanks

Mario
2 months ago

@Paul Frankowski
Personal question: What firewall component do you use and can recommend to us joomla users?

Log in to reply.