Help with a virus on a Joomla 3 site

Budget: 1500 UAH Deadline: 2 days

Hello. I have experience with Joomla. I am ready to complete the task. Feel free to contact me.

Budget: 1500 UAH Deadline: 1 day

Good day! I cleaned Joomla after the hack specifically due to SP Page Builder and JCE — I know these vulnerabilities, shells usually hide in tmp, images, and replaced index files. I will remove active attempts, eliminate backdoors, update or temporarily disable vulnerable extensions, and check .htaccess with the configuration for external redirects. I will start today and will finish in a day. Access will be via SSH/cPanel, and is there a clean backup left before the hack for verification?

Budget: 1500 UAH Deadline: 3 days

Denis, I see your site on Joomla 3 is under attack due to vulnerabilities in SP Page Builder and JCE. It is important not just to remove the virus, but to close all entry points to stop further hacking attempts.

I will analyze the logs, find and remove all infected files and backdoors. Then I will update the specified components to the latest versions and check for other possible weaknesses. Your Joomla will be clean and secure.

Do you have access to the site files and database, as well as a current backup made before the attacks began?

Budget: 1500 UAH Deadline: 2 days

Good day, Denis. I will help you resolve the issue. I will analyze the logs and check if there were successful attempts to exploit vulnerabilities in SP Page Builder and JCE. I will conduct an audit of Joomla, check for the presence of malicious code, web shells, and changes in system files, update the CMS and extensions to safe versions, eliminate the discovered vulnerabilities, and set up protection against repeated attacks. After completion, I will provide a report on the identified issues and the work performed.

Budget: 1500 UAH Deadline: 1 day

Hello. I know Joomla, I know how and where to look for viruses. Feel free to contact me.

Budget: 1500 UAH Deadline: 2 days

We need to stop active hacking attempts through SP Page Builder and JCE, clean up already abandoned shells/backdoors, and close vulnerabilities.

Steps: first, I will go through the file system using grep for known signatures (eval+base64, preg_replace with /e, web shells) and check modified files by date. Then I will update or temporarily disable vulnerable extensions SP Page Builder and JCE until a patch is available. Finally, I will check the .htaccess and Joomla configuration for external redirects and hidden code.

Please let me know if there is access to the hosting panel (cPanel/SSH) and if there is a fresh backup before the hack to compare the current state of the files.