Problems With Assets Remaining Following Recent Vunerability Holes
Lorna Guttormson
Our site has had extremely slow response today - up to 13 seconds to display a page and high resource usage. I have spent much of the day tracking this down with the help of ChatGPT. Here is a summary of history and our findings:
- Joomla 6 site.
- SP Page Builder upgraded from 6.6.2 to 6.7.0.
- Site was rebuilt from clean source after a previous compromise.
- Security scan (WebHosting Canada Safe Site) is clean.
- Front end appears normal.
- Apache logs show many 404s for missing files such as:
- /media/com_sppagebuilder/assets/iconfont/icovxkyvg/style.css
- /media/com_sppagebuilder/assets/iconfont/icotagluk/style.css
- The files do not exist on disk.
- test2_sppagebuilder_assets contains matching records:
-
- an example of the missing assets - id: 15 type: iconfont name: icovxkyvg title: icovxkyvg assets: ['ico ico-x'] css_path: media/com_sppagebuilder/assets/iconfont/icovxkyvg/... created: 2026-06-22 12:12:59
It seems many of these should be deleted from the database - but perhaps not all . Are these orphaned custom iconfont records? Is there a supported way in SP Page Builder 6.7.0 to regenerate missing iconfont assets, or should unused rows in #__sppagebuilder_assets be removed?
What should I do now to move forward?
Atick Eashrak Shuvo
Accepted AnswerI apologize for the inconvenience caused. Could you please check now and let me know if the issue is resolved on your end?
Looking forward to your response.
Best regards
Paul Frankowski
Accepted AnswerHi Lorna,
you forgot about two basic things:
- Update to last version 6.7.1
- Scan site using our MuRu scanner (github) and clean infection, update will not remove files uploaded by hackers. This is general rule for all extensions in Joomla. Worth to remember.
basic guide: https://www.joomshaper.com/documentation/sp-page-builder/troubleshooting#how-to-clean-an-infected-joomla-4x-6x-site
Lorna Guttormson
Accepted AnswerThat has fixed our test system - but I had not addressed the prod system to you as it seemed the same problem . I have now updated our prod site to 6.7.1 but it is still very slow. I see that all but the first record has been removed from test2 sp-pagebuilder_assets. Should I be doing the same on our production or is there something more you have done?
Lorna Guttormson
Accepted AnswerThank you for your help . I have now deleted the many asset entries and many .htaccess files. I haven't run your utitlity from github as I don't know how to download the file directly from the dist directory - I see no download option. Could you send directions? Our prod site is running smoothly now.
Paul Frankowski
Accepted AnswerThere is, just click on file name ;]
anyway here is direct link >> https://github.com/zkrana/joomla-security-scanner/blob/main/dist/com_muruguard-2.7.1.zip
then install it inside joomla, like any other component, then find it on left menu
Lorna Guttormson
Accepted AnswerThank you for this. My scan shows some problems that I think I understand the cause but would like to check with you before I proceed. The scan indicates shaper helix and cassiopiea (and also com_search) have no matching #extensions. I think this is likely because of the way I restored my site. I created a complely new site starting with pitech_quickstart_j6 with a new database. When I was confident that all was working I then, only then, connected to my production database.
My question - do I need to start again to fix this or is there some way to introduce these 3 to my database - perhaps with entries to the #_extensions?