Site URL incorrect - PLEASE help!

My client's hosting company recently had a hacking problem involving a Russian website being planted into certain .htaccess files causing a redirect.

Those files have been remedied but now, post Media Temple's fix, the client's base site url is incorrect. Does anyone have any reason as to why this is happening? It's normally www.example.com but now it's showing www.example.com/gs-bin/.

I've tried:

• Using the default htaccess files and removing the comments.
• Manually setting the site url base reference which works partially but breaks on lightscripts, manager backend, etc.
• Upgraded MODX from 1.04 to 1.05.
• Double checked the paths in the system settings just to be safe.

None of these have worked and I'm at wits end.

Help!!

Thanks,
Nick

Hello Nick,

It sounds like they may have shifted things around some, could you confirm everything is in the same place? Also did you clear the site cache?

If not try clearing the site cache then visiting the site from the correct domain. If that doesn't work can you tell us more about the hosting (GS/DV?), how you corrected the hack, etc.

Thanks

Hey there,

I actually just tried to install a fresh copy of Evo 1.5 (I currently use Rev but don't have time to convert the existing site from Evo to Rev) and it produces the same result.

Upon going to /manager it redirects to domain.com/gs-bin/manager. I switch it from that to just /manager and it gives me a "possible CSRF attempt". I know how to get around that error message but regardless, the problem is still in place.

I believe the hosting is on DV and they had the client correct via an htaccess file; however, if this is a fresh install I'm not sure why the problem is happening.

Argh!!

--

Update: my client deleted an htaccess file outside of the HTML/www folder which contained the Russian hacker website redirect and since then, it's been giving us the issue. [ed. note: nickwonderment last edited this post 15 years, 1 month ago.]

Turns out when the client deleted the htaccess file which had the hacker redirect, it also took this with it:



Whoever at Media Temple who instructed him to simply delete the file should be fired. Anyway, I hope it helps anyone in the future who comes across this pain in the ass error (free of MODx).

Thanks!

Hello Nick,

Thank you for sharing the solution. You may want to poke MediaTemple as your client shouldn't need to have those lines in a .htaccess file for the site to function properly.

If you run into any further issues let us know.