Hi Tom,

Thank you for sharing your findings.

Could you please share a backup of the affected website with us? We would like to restore it in our local testing environment and perform a thorough investigation to identify the source of the infection and verify exactly what happened.

This will help us determine whether the issue is related to the template itself or whether malicious code was injected into the site after it was compromised.

Since the backup may be large, you can upload it to https://files.fm/ and share the download link with us. Once we receive the backup, we'll analyze it locally and get back to you with our findings.

We look forward to your response.

I had the same experience and we immediately discarded the site. they would have used the custom css and js fields to embed malicious code. On top of that they would have enabled the old versions of the captcha plugins. Disabling them doesnt work.Further analysis determined that:

/usr/bin/x86_64-systemd is not associated with any installed operating system package. The file appears to be a standalone executable designed to collect authentication-related information. The executable contained logic that referenced user credentials and attempted outbound communication using curl. The script was configured to send data to the external IP address 194.233.93.210,

Dear Joomshaper Team, I got the same captcha-malware-attach again on a different website. I will under "hidden content" share the login credentials from the infected website with you, please log in, you can then make you own backup and post the solution on this place. Many thanks in advance, Thomas

Thomas, Problem:

Login denied! Your account has either been blocked or you have not activated it yet.

To clean site from malware you have to use extension (free). General guides:

• https://www.joomshaper.com/documentation/sp-page-builder/troubleshooting#how-to-clean-an-infected-joomla-4x-6x-site
• https://www.joomshaper.com/documentation/helix-framework/joomla-security-tips

Yes, we can do that as well, but in the basic level.

It's activated now, sorry for the inconveniences! Please try again, hopefully you find a solution to close the captcha-malware-attack in your templates for ever! Many thanks in advance, Tom

Danke Tom.

I have to be honest with you, partialy it's also your fault that site was infected. You didn't update Helix and SPPB in the last few months. You have to make important updates at least each month, and check site admin more often - what update is needed and why.

Yes. I made quick cleaning. Now all should be OK.

Dear Friends, I definitely feel guilty about the missing updates, but would be happy about a tutorial how to quickly clean this issue. Is it right to...

• switch to an alternative Template
• de-install Helix and all Plugins
• reinstall Helix newest version
• switch back to helix template

Is the malware then completely deleted? Can you confirm? Best regards

"tutorial how to quickly clean" - you got it already, I sent links to documenation (look up).

Yes, the main issue that you had was removed. Now you can ask also the hosting company for extra scanning.

Last tip: if you have template based on Helix Ultimate already, always uninstall all others templates, and plugins from old template.

Many thank and all the best from a big JoomShaper-Fan ;-) Thomas

You're welcome.

Please mark topic as solved, link is under Replay