Website Shape 5 Has Spam / Pop UPS

Dragos01

Hi,

When i open a shape 5 older template website i have now these annoying pop-ups.
www.ahtim.nl (Chinese Restaurant)
Where they come from? A JS File but its in the core?
How to remove them.. Or to patch them. it leads to get.whitellilli.icu

Dragos

francus641

Dragos01

Hi, your site has been hacked. If you have a backup from before the attack, try restoring it.
Otherwise, if you don't know how to do it, you'll need to contact someone who can clean up an infected site.

Dragos01

Hi, yes i know its hacked..

But i want to know how the hack could happen, and maybe need a fix from the template or module.

Dragos

saguaros

Hi Dragos,

Sorry to hear that your Joomla site was hacked. I would suggest the following steps:

Take a full backup of the current website (files + database) before making changes
Contact your hosting provider to check the log and they can find the culprit and ask them for help to scan and remove any malicious files/code
Update Joomla core and all extensions to the latest compatible versions
Remove any unused/outdated extensions or templates
Change all passwords (Joomla admin, hosting, database, FTP)
Check user accounts and permissions for any suspicious access
Add security measures (firewall/security extension, backups, monitoring)

Regards,
Hien

Dragos01

saguaros

I have done this.. but all standard modules are inside... I just want to know where and how they could pass these.

Its no more on the webiste.

Think it the older template has something to do about this.. its Shape5 from latetst update.
The Image Content Slider is also a bit old from 2024

Dragos

saguaros

Dragos01 I think the hosting provider can find the culprit though.

If not, you can restore a backup from previous working version.

Dragos01

I am the provider :-) I put the backup.

I will look further.

saguaros

Dragos01 You can try a backup of previous working versions.

Dragos01

https://www.joomla.org/announcements/release-news/5955-joomla-6-1-2-5-4-7-security-bugfix-release.html

Check this... Think they found out why..

Update ASAP!