attacked by a Virus

Hi everyone.
I just wanted to share something.
Today, an attack targeted to WordPress websites infected my site, which uses MODx on Godaddy server.
The people at GoDaddy didnt help or provide any solution or suggestion, and there were lots of users out there reporting the issue.
I was able to solve it myself and clean my Modx installation using a WordPress solution, which is interesting.

Is there a way to make a backup of the MODx Site?

My preferred way is to install BkupMODx.

However, you can also use the Manager’s database backup (Tools -> Backup) and simply download all of your site’s files via FTP and zip it up together yourself.

Out of curiosity, can you tell me what exactly this "virus" did to your site?

Hey Softwell,

Thanks for your suggestion!
Yes, the virus was HOLASIONWEB.
Here is the link for the news
http://www.wpsecuritylock.com/breaking-news-wordpress-hacked-with-holasionweb-on-go-daddy/

Perhaps I did something wrong for my installation or GoDaddy is just not good enough to protect their users.
e.

From scanning the comments of go-daddy users on that link, it looks like lots of other non-wordpress websites were hit including your modx site -- so it seems to be a general go-daddy vulnerability for php sites. One non wordpress site owner below:

"The hack allows them to modify all .php files on the entire server, not just your hosted package.

I don’t even use Wordpress, but because I use GoDaddy for shared webhosting, my site was hacked along with everyone else’s accounts on that machine.

I’m moving."

You are right!!!
It is unfortunate that such a big company like GoDaddy is not capable of providing security and customer support.
Do you, by any chance, know how to change the DB password on MODx?... like a config.php file??
Thanks for the help.

e.

Hi,

To change your db password you would need to do this in your godaddy control panel then edit /managed/includes/config.inc.php and update the password.

I would also advise that you check any recently modified files on your website as the hacker may have injected code into your php files or created new ones.

Aaron

Quote from: Onesmarthost at May 13, 2010, 05:38 PM

Hi,

To change your db password you would need to do this in your godaddy control panel then edit /managed/includes/config.inc.php and update the password.

I would also advise that you check any recently modified files on your website as the hacker may have injected code into your php files or created new ones.

Aaron

THANKS Aaron!
Will make the DB change and will also look for any strange thing on PHP files, but there are too many to look up.
Is there any kind of tip you could suggest to identify any new file on the site?, perhaps comparing it with my extracted files or looking into an specific folder??

Thanks again to all of your support, I really appreciate the help of the MODx community!

You can look at the file modification dates and see which ones have changed lately.

My understanding is that it modifies *all* php files at the site.

There is reportedly a script to fix things here: http://www.danielansari.com/wordpress/2010/05/holasionwebcom/

I would recommend that you download all your website files, then upload the MODx install which you was using from fresh, then check your local copy of /manager/includes/config.inc.php and upload this.

Then visit your website i.e. www.domainname.com/install and run the MODx install in upgrade mode.

You will also have to upload your images and site template files as well (but check them first to make sure they don’t include extra code).

Thanks Aaron

I recommend running from GoDaddy. Their response to date to this issue is utterly irresponsible, and I can almost promise you’re going to run into it again:

http://smackdown.blogsblogsblogs.com/2010/05/13/hosting-with-godaddy-might-want-to-rethink-that-decision/