My website address is http://bethelrc.org
Google is reporting it may be hacked, when I look at the file system, there are many unauthorized folders and files recently created. I deleted all these malicious files that I was able to find and submit my website to google for review. Also there are many unauthorized users and articles on Joomla backend, I deleted all of them.
However, today one of my users report that when he opens the home page he sees a totally different article, screenshot is as follows:
Looks like the hacker not only injected files but also hijacked Joomla system. Because when I open the website I see our own homepage. So my question is, technically and joomla-wise, how is this possible that when different users open homepage they see different things? Or, do they manipulate the database so that at some certain time homepage is pointing to this article? I look at my backend but I couldn't find this injected article, where could it be stored?