Hi, 2 months ago I've buyed clothing store template, after 1 month my website was invade by pornospam, link etc, so I delete everything and reinstall it, Now a few days ago same story, but now is different, I've got an email from google analitics saying that my website as some suspicious file, and after opening the ftp I've found a lot of file.rar and new folders and everyday I've new files on the FTP. My host send me also this:
Suspicious file on your FTP:
./modules/mod_cf_filtering/assets/proxy.php
./modules/mod_os_imagegallery_pro/tmpl/default.php C
./modules/mod_menu/tmpl/default_url.php
./media/editors/codemirror/mode/info.php
./media/kil-showtopic.php
./media/nnframework/images/search.php
./media/mod_languages/session.php
./administrator/modules/mod_stats_admin/tmpl/stats48.php
./administrator/components/com_k2/views/item/view.html.php
./administrator/components/com_templates/views/code.php
./administrator/components/com_templates/controllers/error.php
./administrator/components/com_jce/helpers/plugins.php
./administrator/components/com_messages/views/message/tmpl/default.php
./administrator/components/com_media/controllers/title71.php
./components/com_config/controller/cmsbase.php
./components/com_simplemembership/views/userprolong/cache.php
./libraries/joomla/filesystem/streams/list53.php
./plugins/system/anticopy/anticopy.php
./plugins/system/anticopy/debug.php
./plugins/captcha/recaptcha/footer.php
I've already:
- change the ftp password
- delete the suspicious file or delete all the code line with strange codes and numbers
- I've also deactivated K2 and deleted ARI image slider (i'm not using it),
I've installed your template via the QUICKinstallation and I've no other component or modules so definitly the problem is in 1 of your component package. I've already send an email to your support.
This is the website:
www.consuelogiacaz.com - > joomla 3.5