We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

has my site bee hacked or is it a virus on the server?

    • 38758
    • 9 Posts
    Marius Cucuruz Reply #1, 13 years, 11 months ago
    Hi all,
    basically there's this bit of code showing at the top of each page - including in the manager (and it seems to be static):

    <div style='text-indent:-9999em'>
<a href="http://www.lexapro-side-effects.org" rel="follow">Lexapro Side Effects</a> <a href="http://www.minoxidilsideeffects.com" rel="follow">Minoxidil Side Effects</a> <a href="http://www.homedepotcoupons.org" rel="follow">Home Depot Coupons</a> <a href="http://www.pizza-hutcoupons.com" rel="follow">Pizza Hut Coupons</a> <a href="http://www.couponstocks.com/walmart-coupons" rel="follow">walmart coupons</a> <a href="http://www.couponstocks.com/office-depot-coupons" rel="follow">Office Depot Coupons</a> <a href="http://www.jcpenney-coupons.org" rel="follow">JCPenney Coupons</a> <a href="http://www.papajohnscoupons.net" rel="follow">papa johns coupons</a> <a href="http://www.couponstocks.com/kohls-coupons" rel="follow">kohls coupons</a> <a href="http://www.logo-quizanswers.net" rel="follow">Logo Quiz Answers</a> <a href="http://hostgatorcoupon.clickwebhosting.com" rel="follow">hostgator coupon</a> <a href="http://www.couponstocks.com/bed-bath-and-beyond-coupon/" rel="follow">bed bath and beyond coupon</a>
<!-- btst --></div>


    Although it doesn't do too much evil, it messes with the design in the front end and causes the manager not to function properly. At the moment I cannot do much in the back end as nothing loads as it should.

    I am no ModX pro, but I am guessing there must be a "$modx->regClient" call somewhere that affects every single page. I've tried searching for words and bits in all the files of the site but to no avail.

    Any ideas as to where I should concentrate my searches?


    Again, here's how the source code of every page (including those in the manager!) begin:
    <div style='text-indent:-9999em'>
<a href="http://www.lexapro-side-effects.org" rel="follow">Lexapro Side Effects</a> <a href="http://www.minoxidilsideeffects.com" rel="follow">Minoxidil Side Effects</a> <a href="http://www.homedepotcoupons.org" rel="follow">Home Depot Coupons</a> <a href="http://www.pizza-hutcoupons.com" rel="follow">Pizza Hut Coupons</a> <a href="http://www.couponstocks.com/walmart-coupons" rel="follow">walmart coupons</a> <a href="http://www.couponstocks.com/office-depot-coupons" rel="follow">Office Depot Coupons</a> <a href="http://www.jcpenney-coupons.org" rel="follow">JCPenney Coupons</a> <a href="http://www.papajohnscoupons.net" rel="follow">papa johns coupons</a> <a href="http://www.couponstocks.com/kohls-coupons" rel="follow">kohls coupons</a> <a href="http://www.logo-quizanswers.net" rel="follow">Logo Quiz Answers</a> <a href="http://hostgatorcoupon.clickwebhosting.com" rel="follow">hostgator coupon</a> <a href="http://www.couponstocks.com/bed-bath-and-beyond-coupon/" rel="follow">bed bath and beyond coupon</a> <!-- btst --></div><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>



    Looking forward to your suggestions.
    Thanks!
      • 18373 ☆ A M B ☆
      • 3,141 Posts
      Mark Hamstra Reply #2, 13 years, 11 months ago
      Hey Marius,

      If it's on all pages including in the manager, it's likely being added to every page through the root .htaccess file. Check it out and make sure there's nothing in there that shouldn't be.

      It would be a very good idea to do a thorough sweep through the entire server to make sure there's no malicious code anywhere else. It's also a good idea to find out how they got in (your host might be able to help) and close that security hole. It could be any script (including MODX), but also a stolen ftp password, or something else on the server level being compromised.
        Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

        Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.
        • 28042 ☆ A M B ☆
        • 24,524 Posts
        sottwell Reply #3, 13 years, 11 months ago
        That almost looks like some kind of setting in the PHP configuration; http://www.php.net/manual/en/ini.core.php#ini.auto-prepend-file

        If you can get into your Manager and see the Reports->System Info, and click the phpinfo view link, you'll get a list of all the PHP configurations.

        Also, try putting a plain HTML (not a .php tile) file on the server, and see how that is displayed.

        Either that, if it's something you want on your site, and the tags for it are just in the wrong place.
          Studying MODX in the desert - http://sottwell.com
          Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
          Join the Slack Community - http://modx.org
          • 38758
          • 9 Posts
          Marius Cucuruz Reply #4, 13 years, 11 months ago
          Thanks for that guys! Quite useful directions there that I had overlooked.
          I've checked the .htaccess files in several places and there was nothing out of the ordinary - just your usual rewrites and redirects.

          I've also tried uploading new PHP and HTML files, just to see what happens (great idea Susan!). However that revealed nothing; here are the 2 files should you need to see them:

          http://www.russiantearoomnyc.com/xmas.php

          http://www.russiantearoomnyc.com/xmas.html


          Now, because I cannot clear the cache in the manager, I have to do it manually via FTP. I've also checked the cached files but found nothing related to this. So my guess is that something that is part of this Modx installation is appending that block to all files... or something.

          I am so lost right now...
            • 18373 ☆ A M B ☆
            • 3,141 Posts
            Mark Hamstra Reply #5, 13 years, 11 months ago
            If it's not in the php.ini or .htaccess and doesn't appear in new files... /index.php and /manager/index.php?
              Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

              Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.
              • 38758
              • 9 Posts
              Marius Cucuruz Reply #6, 13 years, 11 months ago
              yeah, this is quite weird. I've checked the template files, index.php and configuration files, as well as htaccess files. The site is on a shared host so I don't have access to php.ini, but considering that the files I've uploaded don't seem to be affected by this, I am inclined to believe that this is a ModX thing (or a ModX component / snippet / plugin) but I just cannot identify it.
              I will further check with the hosting company, see what they can give me.

              Thanks guys for your replies and support. I will update should I find anything that is worth your time.

              Cheers!
                • 38622
                • 2 Posts
                jpropes Reply #7, 13 years, 11 months ago
                If you have console/ssh access to your site, you can do search to find where that code is coming from. Head to the root directory of your site and do the following:

                grep -Rn "Lexapro Side Effects" *

                Note that I just picked a phrase at random out of your posted source code. You could use anything that's suitably unique. If you get any hits, it will tell you the file that's been changed. If you don't get any hits, then now you know that the problem is in your database.

                Regards,
                -JP
                  • 38758
                  • 9 Posts
                  Marius Cucuruz Reply #8, 13 years, 11 months ago
                  Unfortunately I don't have SSH access, but I've downloaded the site and used phpDesigner to search for keywords throughout and found absolutely nothing. I mean, I've searched for words lik "follow", "gator" or "cupon" and found nothing related to this. So it is either a code split into several variables that are eventually put together to form that, or it is loaded via RPC or SOAP...

                  Would it help re-installing MoDX or trying to upgrade? (btw I am using Revo 2.1.1)
                    • 28042 ☆ A M B ☆
                    • 24,524 Posts
                    sottwell Reply #9, 13 years, 11 months ago
                    Interesting... note that the .php file has an extra doctype, head and beginning body tag, while the plain .html file does not.
                      Studying MODX in the desert - http://sottwell.com
                      Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
                      Join the Slack Community - http://modx.org
                      • 38758
                      • 9 Posts
                      Marius Cucuruz Reply #10, 13 years, 11 months ago
                      that was part of the phpinfo() output; sorry for the confusion. I've removed it now.