With this version, it’s definitely worth running another scan on your sites – both with the much improved malware scan and the core file check, which now also looks for injected files.
Until now, the malicious file scanner could only find stuff that someone had seen before – it needed a known pattern. With 2.7.10 (Changelog) we’re adding three new methods that don’t rely on any patterns at all. And the core file check used to only see if a Joomla file was changed or missing; now it also spots anything that’s been sneaked in alongside.
New: Pattern-free searching
Extended time window after a find. If someone leaves a backdoor, they almost never leave just one – the siblings pop up at the same time. HTProtect remembers when something malicious was definitely created on your site and shows every other program file from that exact moment. This memory survives cleanup: even if the found file is already deleted, it will keep hunting for its siblings for 30 days. On an infected client site with 11,366 PHP files, a single clue led exactly to the four backdoors – without a single innocent file in the mix.
Detection of backdated files. The modification date of a file can be freely set. But the date since the server knows the file can’t be faked. If a file pretends to be much older than it really is, that’s deliberate deception. This method doesn’t need a previous find and works even on sites where nothing has ever been found.
Check of the Joomla protection line – defined('_JEXEC') or die. Almost every Joomla program file starts with a line that stops direct browser access. A backdoor wants the exact opposite and leaves it out. This check isn’t done blindly but folder by folder: only where the vast majority have it, does an exception stand out. Tested on 14 real sites with about 180,000 PHP files, not a single false alarm remained – but it did expose a backdoor disguised as cache management, which no pattern had caught.
Suspicion remains suspicion. These findings are shown in a separate, clearly marked section. They don’t turn your site’s status red or trigger any notifications. They’re hints, not proof – take your time to look at each file, mark it as safe permanently or remove it.
The core file check now looks both ways
Until now, it only checked if a delivered Joomla file was changed. But nowadays, a hack rarely changes an existing file – that would be noticed immediately. Instead, they add a new one alongside. That’s why the check now also lists files in Joomla’s own folders that normally shouldn’t have any foreign files. Everything explainable is named and collapsed down; only what really needs attention stays at the top.
Cleanup is now even faster
If you’ve got 95 unresolved files in front of you, you want to look at them one by one and then clean them all up in one go – not click away 95 confirmation dialogs.
- Expand all content loads the files one after another and shows progress on the button.
- Filter by modification date: A hack drops its files all at once. 86 finds with the same date are one incident, not 86 separate problems – and now you can filter exactly like that.
- Delete all remaining removes exactly what’s still listed at the top at the end. If a time period is selected, it only affects that.
- Files locked by the host can finally be removed. Some hoster virus scanners revoke permissions on a found file instead of deleting it – so removal silently failed. And where a file can’t be removed, the reason is now shown instead of the click doing nothing.
