[FLEXIcontent v2.0.0] Hacked website @ J2.5.28 needs to be migrated to 3.4.x and FLEXIcontent v3.0.x

Thanks! I renamed the file and the extension of the file. I did some audits with watchful.li and there is one left for flexicontent, but I don't that that can hurt. The others are Joomla's own once. RSfirewall not watchul.li's compare function does respond to these files. So it's apt to be good now.

/components/com_flexicontent/TODO.php system (vistamedia) Possible PHP Injection (Unix command)

/libraries/vendor/joomla/application/src/AbstractDaemonApplication.php system('export HOME="' . $info . '"'), passthru('kill -9 ' . $pid), system (mostly BSD-style systems) Possible PHP Injection (Unix command)

/libraries/vendor/phpmailer/phpmailer/class.phpmailer.php popen($sendmail, 'w')), popen($sendmail, 'w')) Possible PHP Injection (Unix command)

/libraries/joomla/application/daemon.php system('export HOME="' . $info . '"'), passthru('kill -9 ' . $pid), system (mostly BSD-style systems) Possible PHP Injection (Unix command)

Hello

did you upgrade FLEXIcontent and Joomla ?
all these files are not the original FLEXIcontent / Joomla files
- they have been modified / hacked

- once a web-site is hacked, it will install backdoors in several places,
and it will reapply / re-hack various files

- thus upgrading Joomla and FLEXIcontent is not enough, you will need to remove all backdoors, if 1 hacked file remains it will re-apply hacks in other files

how would I be able to do that? How to know which of those files are backdoors? Is there a tool that removes them? Or am I free to remove them manually? Including the core joomla files like the deamon.php file?

O, btw, to answer your question. Yes I updated every component. Apperently and logically it will leave the non core files which are hacked files. I thought an audit and rsfirewall would fix the hacks.

Hello

this might work:
- take website down
- make a backup of the joomla folder
- delete all files reported as suspicious, including core files
- extract Joomla package into the folder and then delete /installation/ folder
thus to get files that you deleted
- go to Joomla installer and re-upload FLEXIcontent and other components

Doesn't flexicontent installation override the current database content of the flexicontent tables? Or any other plugin for that matter? Never knew that could work! Cool! gonna do that right away!