0

Sucuri reports an alert about a suspect malicious code on 3 different Joomla sites. One of them is now blacklisted only by Mcafee and not by Google, Norton, Bitdefender and so on. On Virustotal everything seems to be ok

Detected issue Internal Server Error

Definition 500-error?v1

Infected url httx://www.sitename.it/404javascript.js ( View Payload )

I scanned my pc and all the website files using Comodo - Malwarebytes - Spybot and no issue detected

I've looked for 404javascript.js on all files and on db. I found nothing. The websites works normally (The blacklisted one is now off line). Htaccess is clean. Log file has just The host doesn't detect abnormalities.

All extensions are updated and come from Jed

Joomla version 3.4.6

php ver 5.4.45

db ver 5.5.45-37.4-log

Framework Helix3

Template shaper helix3

Pagebuilder

Simpleportfolio

One of these sites was published two days before Sucuri alert. I've of course a backup but I'd like to understand something more about 404javascript.js

2

This 500 error is an error we're receiving from your server. That 404javascript.js file is not a real file, it's a temp file we create when scanning the domain. Meaning, it won't be on your server, but something is causing an error to generate.

Have you by chance looked at your error logs?

On a side note, if you contact the Sucuri Labs group they'd be happy to help you diagnose this further. You can reach them at labs@sucuri.net

Thanks so much

Tony

  • Welcome to the Joomla Stack Exchange site Mr. Perez. I didn't expect the Sucuri CEO to answer this one. :) – Neil Robertson Dec 19 '15 at 1:16
  • Thanx for answering Mr Perez. I'll surely contact the labs – pranky Dec 20 '15 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.