18

I recently came across a site giving away good quality themes for free - but once downloaded it turned out that all the themes contained poorly concealed malware. Thankfully on this occasion my anti-virus picked it up.

What are the common signs that a theme might contain malware, are there any obvious or well known tricks that I should be aware of?

Improve this question
2
  • 3
    Would you care saying how exactly that malicious code looked like? Did you investigate?
    – Valentin Despa
    Commented Apr 30, 2014 at 18:29
  • 1
    My virus scanner (NOD32) flagged up a .js file in the downloaded zip file as adware - a brief inspection showed this to be the case and I chucked the file away - but that got me thinking.
    – toomanyairmiles
    Commented Apr 30, 2014 at 19:31

3 Answers 3

Reset to default
12

Since you're looking for free templates I assume you're not looking to spend extra, but mysites.guru (formerly myjoomla.com) has excellent security scanning.

The details of what you're looking for:

  • start with looking for any inserted iframes.
  • Then look for any php files that are not the index.php or component.php, etc layout files..and if you see anything besides Joomla classes in them, they may be serving the malware.

Now, a commercial template will have several supplemental php files, so not all additional php files are bad, of course.

The biggest "gotcha" though is the iframe.

Improve this answer
2
  • Agreed on MyJoomla - costs, but worth it.
    – codinghands
    Commented Apr 30, 2014 at 19:36
  • I've also seen base64 encoded content used to hide malware. Look for echo base64_decode( in the template files, or look for external links in the source code in your browser.
    – johanpw
    Commented Jul 31, 2014 at 21:16
11

Perhaps there is only one safe answer - only download direct from the original creator and preferably from a well known template house. Most of the commercial template devs do at least one free template. Do your research on the creator as much as the template ;)

Improve this answer
1
  • You make a very fair point, but the proliferation of template sites makes this very hard for the unwary. The answers to this question are really for them.
    – toomanyairmiles
    Commented May 2, 2014 at 8:36
5

I would always favour any free software (not just Joomla templates) that is available, and easily scrutinised, on Github.

As Hils rightly points out, never ever download a template from any other provider than the creator, it's almost guaranteed that you'll get a dose of digital pox that way.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.