Joomla Slider Support

Hi,

I have issues with default.php file in tmpl folder. Every few hours my site stop working because of this problem. Report on the malware detection in the OS Touch Slider is below:

malware detect scan report:
SCAN ID: 112614-0100.26279
TIME: Nov 26 01:13:19 +0000
PATH: /var/www/vhosts
RANGE: 1 days
TOTAL FILES: 41745
TOTAL HITS: 2
TOTAL CLEANED: 0

FILE HIT LIST:
{HEX}base64.inject.unclassed.6 : /var/www/vhosts/alfa-arthro.com/httpdocs/modu...der/tmpl/default.php => /usr/local/maldetect/quarantine/default.php.1205
{HEX}base64.inject.unclassed.6 : /var/www/vhosts/alfa-arthro.com/httpdocs/modu...der/tmpl/default.php => /usr/local/maldetect/quarantine/default.php.3180

Can you help me with this?

Hello,

best solution with that: please show that error to your host provider and ask from he: please correct configure malware detect scan.

I am not host provider so to me difficult advice to you with that, but you may :

- add to malware config for file tmpl/default.php by pass for that check
- or turn off at all these check

we in file tmpl/default.php - use function base64_decode - with it help we move from admin setting all images and all images parameters.

Thanks,
OrdaSoft team

Hi,
also to my website, I have trouble with Default.php in tmpl folder, after few hours the provider delete the file and I've asked to my provider that report from antimalware as follow:

{HEX}base64.inject.unclassed.6 : /data/vhosts/miositoweb.it/template.miositoweb.it/joomla3x/modules/mod_os_touchslider/tmpl/default.php => /usr/local/maldetect/quarantine/default.php.32546
{HEX}base64.inject.unclassed.6 : /data/vhosts/miositoweb.it/template.miositoweb.it/joomla3x/modules/mod_os_touchslider/tmpl/default.php => /usr/local/maldetect/quarantine/default.php.14455

absolutely don't want to change set of its antimalware software, I mean they don't push down security level and I agree with them, but for this reason the effect is that I can't buy any template of OrdaSoft company.
Any suggestion from OrdaSoft team ?
Thank you
Giorgio

Dear Giorgio,

In file that your provider deleted, we've used standard php function base64_decode
php.net/manual/en/function.base64-decode.php

We used it for data storage and increasing page speed.

We believe that antimalware software reports this function, because it can be used in malicious purposes. But other functions can so.

Contact your provider and ask how their antimalware software deals with this php function. You can send them link to php.net and describe that it is standard function and explain that it was used properly.

Best Regards,
Anna
ordasoft.com

Thank you very much Anna fro you prescious suggestion.
I submitted that to my provider and they are working to analyze the issue and, I hope, put that function in the exclusion list of the malware analysis engine...

I will update you.
Giorgio

Good luck.

If you face any problems, please contact us through our contact form.
ordasoft.com/About-us/OrdaSoft.html
Thanks,
Taras
OrdaSoft team