Interesting. Well first have them change their passwords and make sure it’s the latest version of all the software.
However it is strange. SEO firms trying to get more link backs?
But, why haven’t you removed it yet?
The code isnt in any of the templates, basically I cant find it anywhere! I have a feeling its being injected somehow!
Brett
Could be in the database? Log into phpMyAdmin and run a search for ’bikinionline’.
Maybe check the main index.php file itself
Was indeed the main index.php file, thanks folks all sorted!
Glad it’s sorted. I wonder how they got in though...
-
☆ A M B ☆
- 24,524 Posts
There may be a script hidden there somewhere that writes to all index.php files, or it could be just the one in the root got written to. You can change the permissions of both index.php files as well as the config.inc.php file to be read-only (if your server configuration permits such settings).
-
☆ A M B ☆
- 3,112 Posts
Quote from: peekaboo at May 26, 2011, 09:39 AM
Was indeed the main index.php file, thanks folks all sorted!
would you PM me the infected file (rename the extension to be txt), and tell me what your host’s name is?
Rico
Genius is one percent inspiration and ninety-nine percent perspiration.
Thomas A. Edison
MODx is great, but knowing how to use it well makes it perfect!
www.virtudraft.com
Security, security, security! |
Indonesian MODx Forum |
MODx Revo's cheatsheets |
MODx Evo's cheatsheets
Author of
Easy 2 Gallery 1.4.x,
PHPTidy,
spieFeed,
FileDownload R,
Upload To Users CMP,
Inherit Template TV,
LexRating,
ExerPlan,
Lingua,
virtuNewsletter,
Grid Class Key,
SmartTag,
prevNext
Maintainter/contributor of
Babel
Because it's hard to follow all topics on the forum, PING ME ON TWITTER
@_goldsky if you need my help.
