Files on one of my customer’s sites was modified by your AV scan. Key Joomla files were renamed to .suspected which of course broke his site. Now, I understand that you guys have to scan and keep the overall site healthy (to prevent DDOS and similar attacks). However, you should be notifying customers – one of your resellers in this case – when such changes are made.
Sorry for posting this publicly here. I opened a ticket this morning about this. But it has been 8 hours since I filed that ticket and I still have not received a response.
hello Skypanther,
We try to do so but cannot always do this. However if it was renamed, it is quite likely it had either an injection of an iframe of javacript code, or base64 encoded data the same as other malware/trojan infections.
When this happens, we don’t always see it as it happens, because it is picked up in log review only, not as it happens.
I’m not sure that we can modify practice here to notify on every such modification, it would basically require extra staff to do so for every notice. There’s not built in to the system way to automate this at the time. we’ve been working on a lot of behind the scene things and this would be a great resource to add, so I’ll definitely add it to the todo list for development
He and I both understand that his site had been hacked. He had failed to apply a Joomla patch and his site was exploited. I’ve reminded him of the importance of keeping his CMS up-to-date, and I think he gets it.
If the renaming is logged as you say, I would think it would be simple enough to set up a script to scan the logs, match up sites with owners (db lookup), and send an email. Of course, the vagaries of an Hsphere environment would probably complicate that. Tools like Splunk might provide log analysis tools that would help automate this, too.
Na, there’s no viavble way to do the hsphere db lookup securely in the way it works. Since it still has billing data, extra care has to be taken. The logs don’t label the entire path, just the file rename/or moved to quarantine, so it has to be seached for, matched by date and found. Not the best thing at all.