We have one site that had strange arabic characters that appeared in the footer. None of our staff worked on the site from the back end of the site in months, so it was weird that it suddenly appeared. Once we googled " OJS ساخت " we realized our site was not the only site that had this strange font in it.
In the end we found there was code placed in ./templates/common/footer.tpl and we just removed the
that was inserted. We still do not know how it got there but we managed to remove it.
One further note to add to what @israel.cefrin said – since it sounds like your site has been attacked, I would strongly suggest auditing everything you have there before you consider it trustworthy. Standard tools like diff can help to identify unexpected modifications or added code.
Regards,
Alec Smecher
Public Knowledge Project Team