Malware scan provided delete option of file, but now Joomla backend not working

I did a malware scan on my site which the results pointed to a suspicious file found in one of my components. It was a language.php file and the interface provided a delete function button but I was a little hesitant to delete it but I did and now the Joomla backend keeps giving me the same error wherever I navigate too;
0 Failed opening required '/homepages/0/********/htdocs/***/administrator/components/com_sppagebuilder/helpers/language.php' (include_path='.:/usr/lib/php8.4')

Now I use SPpagebuilder on other sites and upon checking before hand the language.php file doesn't exist in any of those sites within the same directories and they all work fine. What am I missing, what could of happened and any ideas on how to fix? 

Much appreciate the help.
Thank you

Hi Drrakken,

I'm sorry you ran into this. Here is how to get your backend back and what I think happened.

1. Get the backend working again (temporary fix)

Create an empty file at the exact path from the error:

administrator/components/com_sppagebuilder/helpers/language.php

with only this content:

This only satisfies the require. It doesn't add any code back, so the error goes away and you can log in again.

2. Why this looks suspicious

You mentioned that this file doesn't exist in SP Page Builder on your other sites. The error still shows that some other file on this site is actively loading it. A legitimate SP Page Builder install wouldn't do that, so most likely the scanner was right and the file really was malicious. The code that loads it was probably injected into another file, and that file is still infected.

To find out which file is loading
- Temporarily delete the placeholder file from step 1, so the error happens again.
- In System → Global Configuration → Logging, set Log Everything to Yes and save. Do this before deleting the placeholder, because afterwards the backend won't load.
- Reproduce the error once, then open administrator/logs/everything.php, via FTP or your hosting file manager. The entry for this error shows which file and line are requesting language.php.
- Put the placeholder file back and set Log Everything to No again, so the log doesn't keep growing.

3. Clean it properly

- Reinstall SP Page Builder from the official package, the same or a newer version, on top of the current installation. This replaces its from its original package.
- Run the Malware Scan and File Integrity check again to confirm nothing else is flagged.
- Because a malicious file was on the server, check that there are no Super Users you don't recognise, change the administrator and database passwords, and update every extension to its latest version.

Once everything is clean, you can delete the placeholder file from step 1 if nothing references it any more.

4. On my sidefixed for the next release. The prompt now also warns clearly that deletion is permanent and can break the site if another file uses the deleted one.

If you get stuck at any step, post the log entry here (you can mask the paths) and I'll take a look.

Regards,
Jose

Sorry if I'm re-posting, I just don't see where I've replied back to you earlier today.

I followed your instruction and placed the language file back into that directory but it's still not working.

Any other thoughts?

Thank you

Hi Drakken,

No, this is your first post today. The key is the everything.php file: there you can see which file is causing the issue. 

Did you reinstall the extension?

I can have a look to it tomorrow if you send me FTP and backend credentials using the "Secure credentials submission" form. 

Regards,
Jose

Sure, let's do that. Can you please send me the link again.

Thank you

The link is accessible when you're logged in. 

Regards,
Jose