How to cure a virus on a website?

Question

Joomla

Good afternoon. A friend has a simple site, about a week ago he began to show a large load on the database and the site itself. Apparently some kind of virus in the php files
If anyone can tell me what to delete - I will be grateful
PS - the Chukchi is not a programmer, the Chukchi is a system administrator. I understand that there is harm in the code, but I don’t rummage in php)
Hoster’s answer

spoiler

Найдены вирусы, спам-ссылки или уязвимые скрипты!
Уязвимые скрипты - 1 шт.
Вредоносный код в php - 2 шт.
Вредоносный код в javascript - 0 шт.

Уязвимые скрипты
/home/p259806/www/xn--e1ajcfyi3f.xn--p1ai/libraries/joomla/session/sess..

Вредоносный код в php
/home/p259806/www/xn--e1ajcfyi3f.xn--p1ai/templates/ot_corpmx/html/com_..

/home/p259806/www/xn--e1ajcfyi3f.xn--p1ai/templates/ot_corpmx/html/com_..

I suspect that the problem is somewhere here?


File content. The code does not fit here, uploaded to the cloud
https://mega.nz/folder/8dM2nTIQ#rjsnn6-6i0j7ytMVK7lR9A

Answer 1

https://github.com/gregzem/aibolit/blob/master/rea...
Good luck!

Answer 2

base64_decode(...) here you got nasty things with 99.9% probability.
Further algorithm of actions:
1. download the archive of the site (can be done using akeeba backup), drive it through the aibolit, it will show you the places of damage, delete the extra code.
2. Update step by step judging by the secondary signs xn--e1ajcfyi3f.xn--p1ai/language/en-GB/en-GB.xml you have version 2.5.5, google how to upgrade from your version to 3.x (There 3- 4 transitional stages will be as far as I remember)
UPD update joomla 2.5 to 3.x
https://joomlaportal.ru/faq/installation-and-updat...