Hot answers tagged joomla
JRoute is the module tasked with dealing with internal urls. The evil code is hooking there to make such urls show their spam page. You could see what they changed by comparing the files with the official ones from Joomla. In the end, you should replace the compromised Joomla php files with the original ones.
Only top voted, non community-wiki answers of a minimum length are eligible