MuRu Guard 5.4.0 Released: Live Protection That Stops Attacks While They Happen

MuRu Guard 5.4.0 stops attacks while they happen, not just after. Until now MuRu Guard found the damage on the next scan. This release adds live protection that reacts during the attack itself: a webshell dropped through an unknown hole is quarantined within seconds, attack tools probing your site are blocked, and a stolen administrator session is signed out. It also finds the hacks site owners never see, such as spam shown only to Google or a skimmer on the login page, and it makes scans fast on large sites.

• Live protection: stop the attack while it happens
• Find the hacks you cannot see
• Faster scans and one-click repair
• Ready for the next Joomla version
• Fixes and security
• Upgrade checklist
• FAQ

Live protection: stop the attack while it happens

Pattern blocking stops known attacks. These protections also catch what slips past it, by watching what an attack does. They live in the Shield plugin 2.4.0 and all need Pro.

• Webshell drop catcher. If a visitor's request leaves a new PHP file in images, media, tmp, files or uploads, the file is moved to quarantine, the IP is blocked for 7 days and you get an alert. It catches the result of an exploit even when the hole itself is unknown.
• Attack-tool probing block. Requests for paths only attack tools look for (.env, .git, wp-login.php and similar), or 30 missing pages in 10 minutes, block the visitor for 24 hours.
• Password-reset and registration flood limits. One IP can ask for 5 password resets and 3 registrations an hour, and a username attacked from 5 or more IPs at once cools down for 15 minutes.
• Under-attack mode. When blocked requests jump far above your site's normal level, MuRu Guard locks the installer and new backend users, lowers the failed-login limit to 3 and stops visitor uploads for 2 hours, then lets you know.
• Stolen-session protection. An administrator session suddenly used from a different browser (or, in strict mode, a different network) is signed out and reported.
• Password confirmation for dangerous actions. Installing extensions, uploading a Joomla update, saving Global Configuration or users, and changing template files ask for your password again if you have not entered it in the last 15 minutes. A stolen session cannot do them.
• Spam-mail flood guard. When the mails Joomla sends from its own forms jump far above normal, front-end mail is paused until you resume it, so a bot cannot ruin your server's mail reputation. Mail sent directly with PHP's mail() bypasses Joomla and is not seen.
• Monitor-only period for new rules. A new blocking rule, such as a fresh virtual patch, first only logs what it would have blocked for 48 hours. A false positive shows up in the Protection Log instead of turning a customer away.

[SCREENSHOT: Options, Protection tab with the live protection switches]

Find the hacks you cannot see

The most common Joomla hacks today are built so the owner never notices them. 5.4.0 looks for them directly (Pro).

• Hidden spam and redirect check. MuRu Guard opens your homepage, menu items and newest articles as a normal browser, as Googlebot, as a phone and as a visitor coming from Google. Spam links shown only to Google, or a redirect only phones get, are reported. The scheduled check repeats it and alerts when something changes.
• Login skimmer watch. The administrator login, site login, registration and password-reset pages are watched for new scripts or forms that send what people type to another site.
• Compare with the original zip. Upload the original zip of an extension or template and see exactly which installed files were changed, added or removed. Most infections hide in template and extension files, where Joomla's own checksums cannot look. The zip is only read, never installed or kept.
• Abandoned extensions. Third-party extensions with no release or update for 2 years, and no newer version offered, are listed. An unmaintained extension is a risk even without a known vulnerability.

[SCREENSHOT: Settings, Analysis with the hidden spam and redirect check]

Faster scans and one-click repair

• Watch the scan as it works. The scan screen now shows each suspicious file the moment it is found, with its confidence and reason, a real progress bar, the time so far and a Stop scan button. This is in Free too.
• Quick scan (Pro). A scan can read only new and changed files, plus every file in upload folders, and the scheduled check can do the same. A full scan still runs every 7 days and after every rules update, so nothing is missed for long. On large sites this is what keeps the scheduled check inside the host's time limit.
• Core file repair (Pro). Joomla's entry points and protection files are compared with the official release. A changed or missing one is put back with one click from the official Joomla copy, checked against the bundled checksum before it is written, and the old copy is kept in Quarantine.
• Last scheduled scan on the Dashboard (Pro). When there are no fresh results, the Run Scan screen shows when the scheduled scan last ran and what it found, and can show those results without a new scan.

[SCREENSHOT: the scan screen with findings appearing during the scan]

Ready for the next Joomla version

A major Joomla upgrade breaks unmaintained extensions, and upgrading a site that is already infected carries the infection over. A new checklist (Pro) shows whether your site is ready: a recent clean scan, a fresh backup, no abandoned extensions, a PHP version the next major supports, and a test without the backward-compatibility layer.

Fixes and security

• The Run Scan screen comes back after results expire (Pro). Opening the Dashboard no longer starts a full scan in the background, so it opens faster.
• An expired license stops at its end date (Pro). Pro switches off at the expiry date even when the license server cannot be reached.

Upgrade checklist

1. Update the MuRu Guard component to 5.4.0.
2. Update the Shield plugin to 2.4.0 through Joomla's updater (since 2.3.1 it updates itself).
3. Open Options > Protection and switch on the live protections you want. Protection Mode must be on.
4. On a large site, switch on Quick scheduled scans in Options.
5. Run the hidden spam and redirect check and the login skimmer watch once from Settings, Analysis, so they have a starting point.

Frequently asked questions