You can't completly rely on the modified date, because it is easy to manipulate it, but in this case they seemed to be too lazy for changing it back. So I unpacked the package and started with searching for changed files - I knew the packaging date of the original files was almost 350 days ago, so I looked for changed files since then. trojans in it), but the result was none (!) of the 54 antivirus programs detected anything.

So I run another virus total scan in expectation to get a very different result (e.g. Funny fact is that the hash sum also didn't match to the provided virus total scan - so the scan was also a fake. The result was that the hash sums did not match - So somebody definitely changed something in the package. That's the reason we show them for every file on our download pages - you should always check if the sum matches the package ones. These hash sums make files clearly recognizable, protecting you from man in the middle attacks or manipulated download packages. So the next step was checking the md5 / sha sum of the file, you can do this on Linux / Unix directly with the terminal - on windows there are a lot of (GUI) programs for that too. There was also a virus total scan link which reportedly belonged to the downloadable file too.Īfter downloading the first thing I noticed was that the filename was different to our normal naming scheme. The website did not look like the typical warez site, it looked pretty reliable, did not have dubious advertisements and they also provided a short description, extension voting and a direct link to the file (which downloaded without any pay-gates or any other typical warez troubles). I took the first result of a simple Google search (Extension name + Download) and came to a huge Joomla and wordpress focused extension warez site (There were hundreds of paid Joomla extensions and templates for ' free' download).

Recently I was doing some research on sites offering our paid Joomla Pro extensions for 'free' download.

Warez business plan pro