Hi Johnny,

Really sorry, danger era came to all CMS.

JInstaller: :Install: Can't find XML setup file

In most cases the problem is with folder permission or wrong /tmp folder path in configuration.php. Nothing new in Joomla, quite common.

If somehow you cannot use Joomla installer, just download template package or Helix quickstart and update/override all files manually using FTP. Update both: template and helix plugin folder: plugins\system\helixultimate

Later, remember to use scanners (components) that we recommend for last weeks in few topics.

follow topics: https://www.joomshaper.com/forum/question/45258 and https://www.joomshaper.com/forum/question/45152

Basic Procedure:

1. Ask hosting support to recover clean site from backup (3-6-9 days old)
2. Update everything inside (all extensions, templates)
3. Scan joomla site using components : https://github.com/zkrana/joomla-security-scanner/ and https://htprotect.org/en/#htprotect
4. Ask hosting support to scan server as well, malware search.
5. Keep 2nd component as firewall for longer period. If you cannot or you don't want to buy a Pro one (RsFirewall or Akeeba Tools Pro).

Paul, thanks. It only appears to be the template i cant uodate, ive already updated the Helix framework. Can i simply download the latest Helix template and upload over my existing ine, and will i lose any customisations?

This hack really is a complete mess. I dont iniw wheree ti start looking for malicious code, something new seems to appear daily. Niw for example, custom script is being injected into the menu, displaying links to gambling websites.

Full scans using third party tookd dont identify the code as malicious, so suggesting these tools won't work. I already have Admin Tools Pro, Akeeba Pro, etc.

Restoring from a backup isn't a viable solution for everyone.

Really losing faith in SPPB after this.

Yesterday backup is OK, if site was hacker today, so all depends.

yes, manually update will override (fix) only template files, will not touch settings or custom.css