Hello, I am working to re-install a site that was compromised by phpThumb. (See security notice here:
http://modxcms.com/forums/index.php/topic,55314.0.html
I’m working with Modx Evolution 1.0.4, phpThmb v1.7.9 (according to the changelog)
Here is the history:
The server shut down the site due to excessive use of the server processor. In response I patched the original vulnerability in phpThumbs, and instructed the server to switch the site back on.
It seems that they were able to continue abusing the server though and it lead to the site being blacklisted by Google.
I immediately moved the domain name to a different web host so that we could notify Google that the site was no longer spreading exploits and request that the site be removed from the blacklist -- which they did promptly.
Now I am reinstalling the site but have not restored the MySQL database as I am worried that I’ll simply be keeping the malicious code. Can anyone give me tips about how to find the code and strip it out of the database? Has anyone else who has been compromised by this security issue found the malicious code?
Any help would be tremendous. Thank you in advance.
