On March 26, 2019 we launched new MODX Forums. Please join us at the new MODX Community Forums.
Subscribe: RSS
  • // Maybe you downloaded a slider or other feature with the AD junk into the js? But on the other hand then you should have the problem now too..
      Evolution user, I like the back-end speed and simplicity smiley
    • I have an EVO 1.0.6 site and an AD is being inserted just before the closing body tag. Below is the end of my footer chunk that is the last thing pulled into my template. The AD is being inserted between the closing paragraph tag and the closing body tag.
      <p><map name="Map">
        <area shape="rect" coords="75,1,109,24" href="[~4~]" alt="Contact Us">
        <area shape="rect" coords="37,1,71,24" href="[~7~]" alt="Site Map">
        <area shape="rect" coords="-1,1,33,24" href="[(base_url)]" alt="Home Page">
      </map></p>
      
      <script type="text/javascript">
              DIS.config.attachments_max_per_post = 5;
              </script>
      </body>
      </html>

      The ads div has absolute positioning that pushes it off the top-left of the page. I downloaded a fresh copy of 1.0.6 from the MODX site and took a dump of the database. I uploaded these along with my template files to a different shared hosting account but the ad still appears.

      I am really at a loss as to how to track this down and remove it. Any suggestions would be greatly appreciated!
      • You need to upgrade your version, else it will keep being hacked!

        Could be a new plugin, check your template(s).
        And clean up your FTP. Remove unused snippets.

        As far as I know the leak could be in: EvoGallery / Jot / AjaxSearch / ForgotManagerLogin


        _________________________

        Edit, When a fresh copy still adds the AD then it must be a plugin or added in a template/chunk.
          Evolution user, I like the back-end speed and simplicity smiley
        • Thanks for your response fourroses666.
          I've moved the post to http://forums.modx.com/thread/97934/site-hacked---help-needed-to-remove?answer=529542. For some reason each time I tried to post, it repeated the original post.