Favicon
PermalinkA Concrete5 site I had worked on previously was hacked today. It appears they got in through the server (my guess...since all three domains on one account were hit). Anyway, they attacked the index.php page which was easy enough to cut and replace the code...but the hacked favicon is still there. Where would that be stored in the files? I want to delete it off the server, but I can't find it. Previously, there wasn't one.
Thank you for your help.

then look at the lines like:
<link rel="shortcut icon" href="http://www....../application/files/9514/2339/9598/favicon.ico" type="image/x-icon"/>
The newer site is simplypink.org. Perhaps, I'm being daft...it happens. If you see the red icon on the bookmark tab you'll see there is definitely one there.