HELP - Site was hacked and in final stages of restoring...

Hello... This is my first post, however I have referred to this site A LOT in the last few months since my sites were hacked.

The information I have been able to find on other threads has been priceless and I finally think I'm in the last steps to getting one of my sites back up and running.

So, a VERY long story short -
My site was hacked. Infected files located and removed.
Usernames and Passwords for the Hosting changed and anything else I could find, changed.
Buggered around with FTP for a long time.
Originally was trying to restore using Modx Revolution and constantly had so many troubles. I since found in one of the files that the previous installation was Evolution.
So I downloaded and installed that, no problems but then could not get the databases or previous files back up and running.
Finally, worked that one out today.

Now, the home page works and I can log in to the backend (site.com/manager) and all the pages, content etc looks just how I left it (*massive sigh of relief*) however whenever someone clicks on my site and follows a link they get "Server Error" (this was in explorer) Screen shot attached.

When I click on it (using firefox) it seems to be redirecting to a spam site (according to Google) but their server obviously is not working... Screen Shot also attached.

I have no idea how this is happening or how to fix it... and my web development / management / creation knowledge is very limited. I've only managed to restore my website after months of trial and error and countless hours googling one problem at a time (and to think, I still have another site to get back up and running after this :'( )

So, if anyone has any ideas, or suggestions I would be forever grateful!

Many MANY thanks.

It looks like your site was set up with Friendly URL's, so maybe check your Friendly URL settings first. FURL's should be on. You might also have to re-configure and set up the .htaccess file if that was corrupted or changed/deleted.

The docs on FURL's are fairly straightforward. Check there for more help.

It would be useful if you state your server's environments and your modx's version.

The live site is in evo, and you're about to convert it to revo ?
For the evo site, try to add base href on top of your template, inside the <head> tags


I couldn't find a strange link inside the HTML source code.
Could you provide use your .htaccess contents?

Hi Frogabog,

Thanks for your quick reply. I have screen shotted my Friendly URLs - they seem to be activated.
the ht.access file reads:

# For full documentation and other suggested options, please see
# http://svn.modxcms.com/docs/display/MODx096/Friendly+URL+Solutions
# including for unexpected logouts in multi-server/cloud environments
# and especially for the first three commented out rules

#php_flag register_globals Off
#AddDefaultCharset utf-8
#php_value date.timezone Europe/Moscow

Options +FollowSymlinks
RewriteEngine On
RewriteBase /

# Fix Apache internal dummy connections from breaking [(site_url)] cache
RewriteCond %{HTTP_USER_AGENT} ^.*internal\ dummy\ connection.*$ [NC]
RewriteRule .* - [F,L]

# Rewrite domain.com -> www.domain.com -- used with SEO Strict URLs plugin
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^www\.example\.com [NC]
#RewriteRule (.*) http://www.example.com/$1 [R=301,L]

# Exclude /assets and /manager directories and images from rewrite rules
RewriteRule ^(manager|assets)/*$ - [L]
RewriteRule \.(jpg|jpeg|png|gif|ico)$ - [L]

# For Friendly URLs
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

# Reduce server overhead by enabling output compression if supported.
#php_flag zlib.output_compression On
#php_value zlib.output_compression_level 5



Edited to add: I searched the forums here for FURLs and according to the post I just read my friendlies should be ok as it reads:
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
making it writable... is this correct? [ed. note: crazyk9s last edited this post 14 years, 9 months ago.]

Sorry - dumb question...

The htaccess file that I opened was ht (dot) access... not htaccess or (dot)htaccess as per your post.

Is this a problem?

Goldsky,

Thanks also for your reply.

Can you please dumb-ify what you mean by "Server Environment"?
Also, I have installed Evo 1.0.4

After it was hacked I installed Revo but it wouldn't work at any point in time, so installed Evo and started to get results.

I am happy to convert it to Revo, but I am hesitant to do so before it is fully functional again. Plus, I am familiar already with EVO so don't really want to change if it means I have to try and learn a new CMS.
If it is better for security however, then shouldn't I me able to run the Revo setup and do the install as an upgrade?
But as I said, I'd rather do this once the site is fully functioning again.

To change the template - is it better to do this using FTP or somehow in the backend (modx) ?
In the section you have pasted in your response, do I need to change as follows:

<html xmlns="<a href="http://www.w3.org/1999/xhtml%22%3E" target="_blank" rel="nofollow">http://www.w3.org/1999/xhtml"></a>

<base href=head>
<title>Home | Crazy K9s Brisbane Dog Training</title>

Apologies to both yourself and Frogabog for my lack of knowledge and I greatly appreciate both of your patience if you are able to help me!

Converting from Evo to Revo is not a simple upgrade procedure. They are completely different, and converting is a complicated process. You should upgrade to Evo 1.0.5, as some security issues were addressed.

Your site uses .htaccess - the ht.access file is simply provided by a MODx installation as a general model. Usually simply renaming it or copying it to .htaccess is all that's required to get friendly URLs working.

Your template will be in the Manager, in Elements -> Manage Elements, and the Templates tab. The
base meta tag should be placed immediately under the title meta tag in the template's head.

Check your config.inc.php file to make sure no redirects or eval() functions have been added to it.

Your server environment means what server? Linux? Windows? What version of PHP? MySQL?

When you're logged in to the manager, clear the cache (Site -> Clear cache). Also check your assets/cache/siteCache.idx.php file. You can empty the siteCach.idx.php file; the manager will re-load it. You can also completely remove all cache files in the assets/cache folder except for the two idx.php files.

first of all, sorry for the ambiguous code.
this forum automatically adds some changes to the www links.
I try this again

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Home | Crazy K9s Brisbane Dog Training</title>
<base href="[(site_url)]" />

ok, without \[code\] tags, it even fails. :(

OMG OMG OMG OMG OMG

(at the risk of sounding lke a 16 year old teen)

THE SITE IS WORKING!

I changed the ht.access and .htaccess files as Susan suggested and all seems to be working. The fonts are doing some funny things, but at quick glance its all there!!

You have no idea how excited I am... the sites have been offline for about 2-3 month now.

I would appreciate if anyone could check the site (www(dot)crazyk9s(dot)com.au and let me know that it works ok on your system.

If I know its up and running I can get started on all the others.

If anyone has any suggestions of how to prevent it from being hacked again in the future I'd love to hear it.

The original hack files were identified as a file titled "anon_ftp" in the main root and then in one of the sub files (under my shop/images) was a file named "dollar.html"
I deleted these two and went through the motions from them.

Perhaps it was possible to be easily fixed but with my limited knowledge it was a long process and I certainly am feeling quite proud of myself now.

Thanks to you all for helping and posting replies in here.

As I said, any recommendations are greatly appreciated.

edited to ad: The shop (website/eshop.html) is not working... but I'm happy to look at that down the track. [ed. note: crazyk9s last edited this post 14 years, 9 months ago.]