Hot answers tagged joomla
JRoute is the module tasked with dealing with internal urls. The evil code is hooking there to make such urls show their spam page. You could see what they changed by comparing the files with the official ones from Joomla. In the end, you should replace the compromised Joomla php files with the original ones.
That is the background noise of the Internet: a bot scanning for commonly used admin interfaces, potentially vulnerable pages and software and well-known PHP backdoors. In itself, this doesn't gives you any indication about the status of your server: it just tells you that a bot scanned it for common PHP entry point. It doesn't indicate if any was found, if ...
Only top voted, non community-wiki answers of a minimum length are eligible