Early Joomla 1.5 site that had it’s tiny MCE compromised. There were PHP files in the image directory, and a few in the root of the website. One was named “wthm1035g.php” and inside was “ÿØÿà”. I have no idea what it is exactly. If someone knows comment.