Hi,

We explained that many times on forum, we have separate topic https://www.joomshaper.com/forum/question/45152. But I will repeat some tips in short form:

1. Use our Free Malware Scanner >> https://github.com/zkrana/joomla-security-scanner
2. Using FTP remove all those unknown files and folders, path you know already (screenshot).
3. In Joomla Admin > Users - check unauthorized Super Users had been created. Remove every account you cannot positively identify.
4. Go to Site Template Styles → Your Template → Template Options → Custom Code → Custom JavaScript. Check the Custom JavaScript field for any suspicious or unknown JavaScript code. If you find any injected code, remove it and save the changes. This should remove the malicious message if it was injected through the template settings.
5. Scan site using firewall. Imunify360+ (hosting panel) or as Joomla component. Remove all suspicious .php files.

Also go into your phpmyadmin as just removing the files in the iconfont folder will not remove the link href entries in your header. Go to your sppagebuilder_assets table and delete every entry inside.

And change your database password. Preferrably all passwords connected to your Website.