I've got a very old installation v2 that I think has been hacked. I've found a URL that is a clone of a template on the system, and has a rogue link inserted. I know that I need to update the whole install, but is there an obvious place to search for the hacked code and remove it as a temporary fix?
1 Answer
The only timeI've encountered something like this is when the site was on a shared hosting. It turned out this happened because of a leaky joomla install on that same server. You can safely delete the file. It's always best to update EE anyway. Just make sure to check if there aren't any more suspicious files on the server, or that files like admin.php/index.php/common.php (so files with common names) don't have alterations. Also check the htacces
