My friend's website powered by Joomla was hacked and I want to fix it. I decided to keep all of the user's files and folders (images, plugins, themes) and remove anything else, then check the kept files and folders for suspicious files. After that, I downloaded a fresh copy of Joomla files and folders.
In WordPress, all user files are stored in the wp-content folder, but I'm not familiar with the Joomla file system. Where does Joomla store such files?
It's not clear to me what you mean by user. Also you do not specify which version or 3rd party extensions you use.
A user registered to your friends website does not have a specific folder for each user. The Mediamanager let every user, including your friend, with access to it see just everything what everybody else can see. By default this is the /images folder in the webspace root.
If you mean with user a developer of the website with file access to the webspace via FTP, SSH or else, then there are multiple locations. Because you asked this question, I think neither you nor your friend have basic understanding in creating a module or component (no offense). So here are the most likely folders which you should backup:
If someone overrided an extension, the override should lie inside the template.
If your friend has custom extensions, then there would be a lot more possible locations. You should ask him about that. That could be a plugin, library, component or module. They all have there own folders in frontend and/or backend.
There is no folder were user changes are made or extensions installed. The closest one would be the template folders. But there are only the overrides of core-files, if made. Nothing is placed there automatically.
If I were you, and I have been there a lot due to my work, I would install a fresh Joomla to a different webfolder/webspace or my own localhost and copy the database and Joomla's configuration.php. Compare the configuration with a default one to make sure, there are no strange things in there. It contains only a JConfig class with public members. No constructor or functions.
The /images folder should only contain images, videos, documents and an index.html. If so, I copy all but the index.html inside /images to the fresh Joomla. WARNING: Even images, svgs, documents, pdfs, ... can contain malicious code I have seen that already.
Then I would check which extensions were installed, still needed and do a fresh install (no copy) of them. Chances are high, that I already have a running Joomla with up-to-date extensions. An now come the tricky part.
In my experience, Joomlas are not hacked via the template. So they should be fine. But to be sure: Normally no one should change the core templates by Joomla. That are hathor and isis for the backend and protostar and beez for the frontend. Joomla installs them by default in the locations I mentioned way up. If changes were made, I would get angry and a cup of coffee because I now have to compare file by file. In a very complex template this can take hours. An IDE with compare functionallity is really helpfull here.
If a 3rd party template is used, I also would do a fresh install and compare the content of the folders. If I am lucky, changes to this template were made only via the backend. If not, get another cup of coffee.
If it is a custom template, I go trough file by file and look for suspicious parts. Custom templates often does not contain many files.
