Remove malicious code from the site

We are looking for specialists or teams to implement solutions at the end client's site. You can submit an offer for one, several, or all tasks. Deadline for completion: max. 60 days from the signing of the contract. Tasks: Implementation of servers, SAN arrays, Proxmox VE, Microsoft Hyper-V, and HA cluster, migration of specified systems, and training for the administrator. Implementation of Active Directory Domain Services, DNS, GPO, and basic system services along with training for the administrator. Implementation of a backup system and NAS repositories along with user training — Veeam. Implementation of monitoring software along with user training — Zabbix. Implementation of ITSM software along with user training — GLPI. Implementation of a PAM system along with user training — JumpServer Enterprise/X-Pack. Implementation of a DLP system along with user training — Safetica. Configuration of switches, network segmentation, and access point along with training for the administrator. Hardening of specified systems and implementation of a honeypot along with training for the administrator. Implementation of Wazuh as a central XDR system, FIM, log collection and analysis, and integration with the WORM repository. The scope includes data reception from other implemented systems and training for the administrator. NGFW will be an element of the target infrastructure, but its installation, migration, and policy configuration will be covered by a separate order. Each task includes pre-implementation analysis, configuration, testing, post-execution documentation, and training. Ongoing administration after acceptance requires a separate order. The exact location and technical data needed for pricing will be provided to qualified candidates after signing the NDA, before the contract is concluded. The offer should indicate tasks, experience, team, deadline, price, travel/accommodation costs, and readiness to sign the NDA.

Good day! Our Joomla website has been hacked. Initially, the attackers defaced it (wrote "Hacked by Antonkill"). After attempts to clean it ourselves, the hackers returned and installed a malicious script: now, when accessing the site, a foreign blurry screen with a fake captcha (phishing/redirect) is displayed. The hosting provider constantly sends notifications about infected files.What needs to be done: A complete audit and cleaning of all website files and the database from viruses, shells, phishing scripts, and backdoors. Finding and eliminating the vulnerability that led to the hack (updating Joomla, plugins, closing holes). Checking the database for hidden administrators created by hackers. Setting up basic website protection (configuring .htaccess, restricting folder permissions, installing security components like RSFirewall or equivalents). Removing the site from antivirus/search engine blacklists, if it has been listed.Please contact specialists who have real experience with Joomla security. A guarantee for the work will be required (that the viruses will not return within a few days). Access will be provided via temporary FTP/SSH.