Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 1 down vote favorite

One of my websites (Joomla) is being blocked by Avast when I try to go to the administrator page. I get the message that there is an HTML:imghack-a [Trj] threat. I guess its a trojan, but I cannot find any information about it on the net. When I log on with FTP and look at both the dates and the server-logs I cannot find any discrepancies or illegal activity. Does anyone know what this is and where to look? Thanks

share|improve this question
I'm not familiar with Avast, but as it's an antivirus program, I wonder if it's complaining about files in your local browser cache. Have you tried deleting your internet history? Or using a different browser? – paulmorriss Jun 2 '11 at 10:10
Hi, Yes I tried it in 3 different browsers and all get blocked by Avast. Which is indeed an antivirus scanner. It simply blocks my access to the page telling me it found this threat. Now obviously I could deactivate avast for this site so I can access the site (I can do so on my tablet anyway) but I just want to find out what this threat is since I fear of being hacked. – Evert Jun 2 '11 at 10:32
You might have better luck with this on the avast forums. They're more likely to be able to tell you if your Joomla site's been hacked or if Avast is simply reporting false positives. – Nick Jun 2 '11 at 11:46
Thanks Nick, I'll do that. – Evert Jun 2 '11 at 13:34
Don't forget to update this post when you get to the bottom of it, though. It might be useful for others. You can post an answer and accept it even though you asked the question in the first place. – Nick Jun 2 '11 at 14:08

2 Answers

up vote 1 down vote

Check your database. There's a chance you've been hit by a SQL Injection and that would not be obvious by looking at FTP and most server logs. With the popularity of Joomla, Wordpress, etc there have been a lot of automated hacks targeting user friendly CMS software. I read something the other day that most malware gets installed to web users by legitimate websites that don't know their database has been compromised. Will post a link if I find the article again.

share|improve this answer
up vote 0 down vote

The "imghack" description would lead me to believe that you've had a malicious image, or script masquerading as an image, on your web site.

Do you have any methods for users or visitors to post their own images on your web site?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.