See: https://www.virustotal.com/nl/url/54830e3053fbddb0d3fc646659d6f21fcf6bb3cfc0704e0c7e92949d7eec808e/analysis/1422352565/
See potentially suspicious file:
/components/com_easygallery/slimbox/js/mootools.js
Severity: Potentially Suspicious
Reason: Detected potentially suspicious content.
Details: Detected potentially suspicious initialization of function pointer to JavaScript method write __tmpvar455140526 = write;
Threat dump: View code: http://jsunpack.jeek.org/?report=fcafa0ab6a6013b01531c76456daff66956748b2
Threat dump MD5: B0DBA40AD208037B27AD30A07581FBE7
File size[byte]: 19181
File type: ASCII
Page/File MD5: B9D5582EF654ED1F05936BCEE4AD7403
Scan duration[sec]: 0.187000
E.Mail Spam and Hacking reported: http://www.abuseipdb.com/report-history/185.17.41.25
http://www.stopforumspam.com/ipcheck/185.17.41.25
Joomla version outdated: Upgrade required.
Outdated Joomla Found: Joomla under 2.5.26 or 3.3.5
PHISH: http://comments.gmane.org/gmane.comp.security.phishings/37191
IP badness history: https://www.virustotal.com/nl/ip-address/185.17.41.25/information/
polonus