Vulnerabilities detected in Hikashop.

Hi,

I checked the list of files in your report and all of them are legitimate HikaShop files. Nothing there is a file added by a hacker, they are all part of the normal package: the payment plugins, the FedEx shipping plugin, our modules, our fields and our views.

The detection type displayed in the report, php.var.function.14, is a heuristic rule of that scanner. It flags normal PHP constructions, like calling a property or a method whose name is stored in a variable, or using base64_decode to pass data in a URL. HikaShop uses these constructions in many places, and so do many other extensions. Akeeba Backup had exactly the same php.var.function.14 detection on one of its own files and it was a false positive there too.

So that report alone does not mean that these files are infected. Note also that the free version of that scanner hides most of the paths behind FREE REPORT LIMITS, so you cannot even see which files it is actually talking about.

That said, as your website was really hacked, it is worth verifying instead of just ignoring the report. The simplest way is to download the package of your HikaShop version from your account on our website and to install it again on your site. That overwrites every HikaShop file with a clean one, the plugins included. Then run the scan again. If the same files are still listed, it is the heuristic rule and not an infection.

For Joomla itself, you can do the same for free with Joomla's own tool: go in System, Update, Joomla, and use the Reinstall Joomla core files button. It overwrites all the core files with the clean ones of your version.

If you want to check file by file, unzip that package on your computer and compare its content with the files on your server, with a diff tool or through your FTP client. A HikaShop file which is different from the one in the package is a file worth looking at. It is also useful to look for files which are in those folders but not in the package at all, and for files with a recent modification date, because that is usually how an infection shows up, much more than through the file names of that report.

About the scanning tools, here are free ones which we find more useful in your situation:

JAMSS, the Joomla Anti-Malware Scan Script. It is a single free PHP file that you upload at the root of your site, call in your browser, and delete afterwards. It also works by patterns, so it gives false positives too, but it shows you the file and the line which triggered the alert, so you can judge each hit by yourself instead of getting a list of hidden paths. You can get it here: github.com/btoplak/Joomla-Anti-Malware-Scan-Script--JAMSS-

Sucuri SiteCheck, on sitecheck.sucuri.net : free and nothing to install, it scans your site from the outside and tells you if injected content or a blacklisting is visible on your pages. It only sees what is public, so it complements the file scan, it does not replace it.

If you have an SSH access to your server, php malware finder is the most precise of the free tools, it uses yara rules and is much less noisy on legitimate code. You can get it here: github.com/jvoisin/php-malware-finder

Akeeba Admin Tools, on www.akeeba.com/products/admin-tools.html : it has a free Core version which is very good to harden the site after the cleaning, but be aware that its PHP File Change Scanner is only in the paid Professional version.

If you find HikaShop files which really differ from the ones in the package, paste their content here and we will tell you what was added.