MuRu Guard Security Scanner

A Joomla administrator extension for finding malware, webshells, rogue users, suspicious database payloads, and SPPB or JCE compromise traces without exposing a public scanner endpoint.

Request Extension
MuRu Guard Security Scanner interface

SPPB

RCE Coverage

JCE

Component Checks

ACL

Admin Protected

Live

Protection Mode

Overview

MuRu Guard installs like a standard Joomla extension and runs inside the administrator area. It uses Joomla's own authentication and permission system, so there is no separate scanner URL, access key, or public file to remove later.

The scanner focuses on real-world compromise patterns linked to SP Page Builder's uploadCustomIcon vulnerability, suspicious JCE paths, core entry-point tampering, rogue Super Users, and database payloads commonly seen after Joomla attacks.

Critical Security Notice

Before scanning a compromised Joomla site, close the original entry point first.

  1. 1Update SP Page Builder to 6.6.2 or later.
  2. 2Update or remove JCE if it is installed.
  3. 3Take a full backup and run the first scan on staging when possible.

Core Features

Protection Mode

  • Companion plugin checks every site request
  • Logs attack pattern matches and brute-force attempts
  • Optional blocking for high-confidence matches

Filesystem Scan

  • Scans media, images, templates, tmp, cache, and webroot paths
  • Covers SPPB and JCE component directories
  • Flags suspicious PHP, phtml, phar, and shtml files

Core Integrity

  • Checks Joomla entry points for prepended payloads
  • Verifies supported core files with SHA-256 hashes
  • Flags fake index.php stubs and configuration backups

Database Scan

  • Finds Helix Ultimate mega-menu XSS payloads
  • Checks SPPB asset rows for injected code
  • Reports template defacement strings

Detection Details

Content signatures

Detects eval/base64 payloads, cookie-gated backdoors, c99/r57/WSO-style shells, stream-wrapper loading, chr-array decoding, and script injection.

Filename patterns

Matches known malware-drop naming, duplicate configuration files, random numeric drop folders, and suspicious top-level webroot items.

JCE coverage

Applies tuned heuristics to media/com_jce, administrator/components/com_jce, components/com_jce, and plugins/editors/jce.

Rogue users

Flags Super User accounts with attacker-pattern names or suspicious local email domains.

Confidence scoring

Labels findings as High or Medium so administrators can prioritize review.

Guided actions

Offers scoped delete, surgical menu params cleanup, and rogue SPPB asset row deletion for current scan findings.

Protection Mode

On-demand scanning finds problems after they happen. Protection Mode, powered by the optional MuRu Guard Shield plugin, checks requests as they reach Joomla and records matches in a sectioned Protection Log.

Protection Mode

Master switch that detects and logs every match.

Attack Blocking

Optional 403 block for high-confidence webshell, SPPB RCE, and known drop-filename matches.

Brute-Force Blocking

Optional IP blocking after repeated failed administrator login attempts.

All protection switches are off by default, and authenticated non-guest admin sessions are exempt from request-pattern blocking.

Cleanup Workflow

  1. 1Review High-confidence findings before Medium-confidence findings.
  2. 2Treat core entry-point tampering as the top priority because it can execute on every page load.
  3. 3Delete confirmed malware files or folders only through current scan results.
  4. 4Clean injected menu params with the dedicated clean action instead of deleting whole menu items.
  5. 5Remove rogue Super Users from Joomla Admin, then rotate credentials from configuration.php.
  6. 6Force logout sessions, check scheduled jobs, and re-scan after cleanup.

Installation

  1. 1

    Install the component

    Upload and install com_muruguard from Joomla administrator under System > Install Extensions.

  2. 2

    Install the shield plugin

    Install plg_muruguardshield if you want live attack logging and optional blocking.

  3. 3

    Enable permissions

    By default Super Users can access the component. Grant Manage, Clean, Delete, or Change Settings permissions to trusted groups as needed.

  4. 4

    Run a scan

    Open Components > MuRu Guard > Scan, choose the checks to include, and review grouped results.

  5. 5

    Configure protection

    Enable the plugin from System > Plugins, then turn on Protection Mode from the scanner settings panel.

Recommended Order

Back up the full site.
Update SP Page Builder to 6.6.2 or later.
Update or remove JCE if installed.
Install the scanner and run a full review.
Clean menu payloads, delete confirmed malware, and remove rogue asset rows.
Rotate credentials, harden upload folders, and re-scan.

Security Model

Joomla ACL

Access is governed by Joomla authentication and component permissions.

CSRF protection

Delete, clean, and settings actions require Joomla CSRF validation.

Scoped deletion

The scanner can only remove items flagged by the current scan run.

Pattern-only cleaning

Menu params cleanup strips matched injection patterns without touching unrelated layout settings.

Read-only scanning

File content is read as text for pattern matching and never executed or included.

Admin-only operation

No separate public scanner file, login screen, or access key is exposed.

Frequently Asked Questions

FAQs