Sucuri detect 404javascript.js It's really a security issue?

Question

Sucuri reports an alert about a suspect malicious code on 3 different Joomla sites. One of them is now blacklisted only by Mcafee and not by Google, Norton, Bitdefender and so on. On Virustotal everything seems to be ok

Detected issue Internal Server Error

Definition 500-error?v1

Infected url httx://www.sitename.it/404javascript.js ( View Payload )

I scanned my pc and all the website files using Comodo - Malwarebytes - Spybot and no issue detected

I've looked for 404javascript.js on all files and on db. I found nothing. The websites works normally (The blacklisted one is now off line). Htaccess is clean. Log file has just The host doesn't detect abnormalities.

All extensions are updated and come from Jed

Joomla version 3.4.6

php ver 5.4.45

db ver 5.5.45-37.4-log

Framework Helix3

Template shaper helix3

Pagebuilder

Simpleportfolio

One of these sites was published two days before Sucuri alert. I've of course a backup but I'd like to understand something more about 404javascript.js

Answer 1

This 500 error is an error we're receiving from your server. That 404javascript.js file is not a real file, it's a temp file we create when scanning the domain. Meaning, it won't be on your server, but something is causing an error to generate.

Have you by chance looked at your error logs?

On a side note, if you contact the Sucuri Labs group they'd be happy to help you diagnose this further. You can reach them at [email protected]

Thanks so much

Tony