Website hacked - Sending spam

[criss_976]

My apologies if I am not posting this in the right section. I've tried as much as possible to read all the instructions first, as suggested.

I am having the exact problem on Joomla 3.0.3.
This is the second time this happens in a week. I have changed all passwords, deleted infected files, had a new installation (I have a legitimate template bought from template monster.com).
I am not able to determine the exact source of vulnerability but on some of the returned emails i get this message that makes me believe the vulnerability is in that folder (sorry I am taking our the domain and replacing with xxxxx):

Date: Fri, 17 Apr 2015 11:16:58 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server310.webhostingpad.com
X-AntiAbuse: Original Domain - nak.com.cn
X-AntiAbuse: Originator/Caller UID/GID - [750 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - XXXXXXX
X-Get-Message-Sender-Via: server310.webhostingpad.com: authenticated_id: xxxxxx/from_h
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/xxxxxx/public_html/XXXX/components/com_users/models/alias.php
X-Source-Dir: XXXXX:/public_html/XXXXXXX/components/com_users/models
Return-Path: lourdes_schneider@XXXXXX

Please let me know if you have any suggestions

Thank you very much

Criss

[Per Yngve Berg]

Mod. Note: split post out f on old Topic in the 2.5 Forum. Please ask your question making a NEW Topic in the proper forum.

Your Joomla is very outdated. the latest version is 3.4.1.

[Webdongle]

http://forum.joomla.org/viewtopic.php?f=714&t=757645