[FLEXIcontent v2.0.0] Hacked website @ J2.5.28 needs to be migrated to 3.4.x and FLEXIcontent v3.0.x

how would I be able to do that? How to know which of those files are backdoors? Is there a tool that removes them? Or am I free to remove them manually? Including the core joomla files like the deamon.php file?

O, btw, to answer your question. Yes I updated every component. Apperently and logically it will leave the non core files which are hacked files. I thought an audit and rsfirewall would fix the hacks.

Hello

this might work:
- take website down
- make a backup of the joomla folder
- delete all files reported as suspicious, including core files
- extract Joomla package into the folder and then delete /installation/ folder
thus to get files that you deleted
- go to Joomla installer and re-upload FLEXIcontent and other components

Doesn't flexicontent installation override the current database content of the flexicontent tables? Or any other plugin for that matter? Never knew that could work! Cool! gonna do that right away!

Hello

what i suggested is about PHP files only
and may work depending on the type of hack you have in your website

- there might be entries in DB that will result in module display executing PHP code
- or in other places too
- also you should change all administrator passwords
etc

for hack .. i recommend aesecure tools !