I discovered that my problem is related to this thred: Security issue: Hacking via submission in OJS 2.4.8
I did all recommendations, but I didn’t find out how to unify the folders on system, so I decide to run a rsync between these folders. And I keep the journals as the main dir_file.
I moved all files to a ojsdata outsite webroot and now I think it is safe. I am not the one who installed this instance, so I didn’t know that files was under the webroot.
Best
Israel