Cache attack injection in Joomla 3.3.6

[yellow_boat]

Hi,
My brand new 3.3.6 joomla website has a strange attack to the cache system.
The page, com_content, mod_custom and few other folder in the cache are injected with a link to "wpthemeschecker.com".
The link is insert into the page in a middle position above the content.

In a first time the cache is clean but after a little while the link start to appear into those file. DB looks clean and template file too.
If you clean the cache every link disappear.

I have few extension up to date:
com_acymailing, com_coalawebsociallinks, com_djslider, com_rokgallery, theme themeexpert Zenith_II free version.

I've already changed all password to ftp and db and admin access but nothing changed.

cache folder has normal 755 permission and file are 644
The problem doesn't occur in the local version on my pc.

Any idea that not invole to simply disable cache?

[brian]

Congratulations you have been hacked. Please follow the advice in the security forum

[Slackervaara]

Have you looked in access logs how this hack was made? You can start to search aceess logs for wpthemeschecker.com.

In master htaccess this is a protection for file injection:

RewriteEngine On
########## Begin - File injection protection, by SigSiu.net
RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC]
RewriteRule .* - [F]
########## End - File injection protection

https://docs.joomla.org/Htaccess_exampl ... ecurity%29

There also might be possible to block:
wpthemeschecker.com via htaccess