Looking at the code, it doesn't really make sense on it's own.
Lets look at what we currently have:
Line 1 is checking to see if
$_REQUEST["mjzM"] is set. Now
$_REQUEST should not really be used as it contains the content of
$_COOKIE, so it is possible that a 3rd party extension containing a form has been compromised.
Line 2 extracts
$_REQUEST, which is an array, but it does it
@, meaning that if there are any errors executing
this code, the errors won't display.
Line 3 terminates the execution of the script and dumps the results, again, being done silently.
$NAQGb are populated from
$_REQUEST and could be populated from the URL easily (as
$_REQUEST contains the data from
Read a little more on the matter here:
What should I do?
- Make sure your Joomla site is updated to the latest version, currently 3.4.6
- Download a fresh copy of the exact version of Joomla you're using. Copy and paste the index.php from the downloaded zip to replace yhe one on your site.
- Ensure all 3rd party extensions are up to date.
Please bare in mind, that this may not be the only malicious code that has been injected into your site, there could be, and most probably is more.
Phil Taylor who is a Joomla expert and specialises Joomla security would be the a great person to have your site checked over:
Disclaimer: I'm not affiliated with Phil Taylor in any way. I've recommended him as he is highly recommended in the Joomla community.