• 1

Read this first!

We do not monitor these forums. The forum is provided to exchange information and experience with other users ONLY. Forum responses are not guaranteed.

However, please submit a ticket if you have an active subscription and wish to receive support. Our ticketing system is the only way of getting in touch with RSJoomla! and receiving the official RSJoomla! Customer Support.

For more information, the Support Policy is located here.

Thank you!

TOPIC: Possible security issue

Possible security issue 14 years 1 month ago #10081

  • Xpresso
  • Xpresso's Avatar
  • OFFLINE
  • Fresh Boarder
  • Posts: 13
Hi, I have RSFirewall installed on a number of my Joomla sites and this morning all of them we're unavailable! I have checked the server logs and somehow all of the rsfirewall.php files in administrator/components/com_rsfirewall/helpers have been deleted hence none of the sites load correctly, has anyone else encountered this?
The administrator has disabled public write access.

Re:Possible security issue 14 years 1 month ago #10082

  • alexp
  • alexp's Avatar
  • OFFLINE
  • RSJoomla! Official Staff
  • Posts: 2253
  • Thank you received: 180
Hello,

We've had a similar report but with further information - and since you are hosted in UK as well, we believe this might be the same issue.
There was a server reboot at Heart Internet - after which the RSFirewall! helper PHP file was deleted. The only plausible explanation would be that the servers are running their own anti-virus/anti-trojan software that might have thought RSFirewall! was a trojan. The RSFirewall! helper file contains some signatures of known malware (by signatures I mean file names and small pieces of code that can be found in malwares, so that it can detect them on your website) and this could have triggered a false alert.
You should contact your hosting provider for further clarification.
Please note: my help is not official customer support. To receive your support, submit a ticket by clicking here
Regards,
RSJoomla! Development Team
The administrator has disabled public write access.

Re:Possible security issue 14 years 1 month ago #10083

  • Xpresso
  • Xpresso's Avatar
  • OFFLINE
  • Fresh Boarder
  • Posts: 13
Hi, I will forward this information onto them as it seems like a likely explanation as i'm also on heart internet, thanks
The administrator has disabled public write access.

Re:Possible security issue 14 years 1 month ago #10084

  • Xpresso
  • Xpresso's Avatar
  • OFFLINE
  • Fresh Boarder
  • Posts: 13
I received the following reply from Heart Internet:

"Our admins have advised us that they do have some new checking systems on the server which may have caused the problems with your sites. They are now looking into the systems to find a way to add an exception in for the module that you are using.

Our apologies for the inconvenience caused."
The administrator has disabled public write access.
  • 1

Read this first!

We do not monitor these forums. The forum is provided to exchange information and experience with other users ONLY. Forum responses are not guaranteed.

However, please submit a ticket if you have an active subscription and wish to receive support. Our ticketing system is the only way of getting in touch with RSJoomla! and receiving the official RSJoomla! Customer Support.

For more information, the Support Policy is located here.

Thank you!