Hacked user on server

[JohanSvensson]

Hi!

Recently one of my clients got hacked, a basic Joomla site with weak password.
I have been investigating the activity on the account and server, and found some files that have been uploaded.

They have been spawning a lot of processes with cronjob on the user. The account is Jailed and php is running as the user so I don't thing they have gone any further on my server. Just this user have this type of activity.

I found one interesting script on my clients account, but its quite hard to "translate" what it's actually doing. (See attached file)
Someone have any ideas?

 

[Infopro]

I have removed the attachment, no need for that sort of thing on these forums.

If you're unsure of what to do here, you might consider contacting your Hosting Provider or hire a System Administrator.

 

[jpearl]

Delete the script, update joomla, delete the bad cron jobs, and see if the issue is resolved.