The main reason for 3.6.4 update was exactly what happened to you!
Security Bulletin  - Core - Account Creation states
"Inadequate checks allows for users to register on a site when registration has been disabled."
Then, additional vulnerability which was fixed by 3.6.4 was  - Core - Elevated Privileges "Incorrect use of unfiltered ...
A few steps I take when troubleshooting these types of things for new clients when they’ve been hacked:
You can add your first site free to https:://mysites.guru which will then run an audit on your site and identify which files have potentially been hacked so you can remove malicious code and/or rogue files.
Reinstall Joomla via components > joomla ...
Finding the "backdoor" might be hard. You can check the access logs for strange requests. Maybe your hosting provider offers other logs like (s)FTP connection logs.
I recommend installing Akeeba Admin Tools to prevent basic attacks.
A good source for ideas to secure a site is this: https://www....
There are many possible ways that the hacker has broken into your web,
I recommend you see these documents:
As to your question I would bet that the hacker could somehow upload a file to your website with a script that creates the user directly into the database.
With knowledge of Joomla tables and function it is ...
Having done a little research on your malicious code, I came across this article which states what the snippet is and how it will effect you.
So you may see the server using a tonne of resources, such as CPU and requests. It may not be Joomla or an extension that ...
Finding the backdoor is indeed hard, but it not impossible. You will need to check all your logs, match the dates for each suspicious entry, until you find the root cause of the issue.
Having said that, you should always run the latest version of Joomla, disable unused extensions, update your used extensions to the latest version, and protect your backend ...
It's not clear to me what you mean by user. Also you do not specify which version or 3rd party extensions you use.
The following is true for Joomla 2 and 3:
A user registered to your friends website does not have a specific folder for each user. The Mediamanager let every user, including your friend, with access to it see just everything what everybody else ...
Is there a pattern to the emails used? For example, do these emails have a certain tld at the end? If that's the case, you can add a regex to the model blocking those emails.
Note: If your website only benefits from American traffic, then you can block traffic from countries that we don't want traffic from. Nowadays, most hosts can do that for you. This ...
You can check the VEL to find out if any of your installed extensions have known vulnerabilities.
Known vulnerabilities are generally patched as soon as possible.
As with any hacked website, you probably have three options:
restore from a known good backup, update Joomla and third party extensions to the latest versions and reset passwords
rebuild the ...
Assuming core files have not been modified it should be safe to reinstall the Joomla files. Ideally, run a backup before you start in case anything goes wrong.
I highly recommend upgrading to the latest version of Joomla (currently 3.6.4) where the Joomla Update component has an option to reinstall core files (this feature was added around Joomla 3.6.0).
As others have pointed, this may be an .htaccess hack. However, we are noticing a trend in the hacked Joomla websites, where such hacks are actually in the core. Try overwriting your core files from a fresh Joomla install (as described here) and see if that fixes the problem.
If you are still seeing the problem, check your non-core extensions (modules, ...
As per https://blog.sucuri.net/2011/05/understanding-htaccess-attacks-part-1.html it may be that the .htaccess file has been compromised and is redirecting certain visitors to a hacked page based on the referrer or similar.
For example, visitors arriving at the website via a Google search may be redirected to the hacked page but ...
Check your .htaccess file, many users are used to search domains in google search box, I have been hacked this way.
Open your .htaccess, activate line wrap and check file.
In the other hand, it's a good idea change your ftp password and then reinstall your joomla from scratch.
Your site has been compromised. You need to take immediate actions, to clean it up and secure it.
You should hire experts, If you are in doubt or don't know how to proceed.
Check these topics for further help:
Joomla Site Hacked
Joomla Security Checklist
Joomla! 2.5.4 Hacked: Having trouble with diagnosis