Site Hacked. AD inserted at bottom of page

1,613 Posts

fourroses666 Reply #11, 11 years, 8 months ago

// Maybe you downloaded a slider or other feature with the AD junk into the js? But on the other hand then you should have the problem now too..

Evolution user, I like the back-end speed and simplicity

7 Posts

teco_aus Reply #12, 9 years, 5 months ago

I have an EVO 1.0.6 site and an AD is being inserted just before the closing body tag. Below is the end of my footer chunk that is the last thing pulled into my template. The AD is being inserted between the closing paragraph tag and the closing body tag.

<p><map name="Map">
  <area shape="rect" coords="75,1,109,24" href="[~4~]" alt="Contact Us">
  <area shape="rect" coords="37,1,71,24" href="[~7~]" alt="Site Map">
  <area shape="rect" coords="-1,1,33,24" href="[(base_url)]" alt="Home Page">
</map></p>

<script type="text/javascript">
        DIS.config.attachments_max_per_post = 5;
        </script>
</body>
</html>

The ads div has absolute positioning that pushes it off the top-left of the page. I downloaded a fresh copy of 1.0.6 from the MODX site and took a dump of the database. I uploaded these along with my template files to a different shared hosting account but the ad still appears.

I am really at a loss as to how to track this down and remove it. Any suggestions would be greatly appreciated!

1,613 Posts

fourroses666 Reply #13, 9 years, 5 months ago

You need to upgrade your version, else it will keep being hacked!

Could be a new plugin, check your template(s).
And clean up your FTP. Remove unused snippets.

As far as I know the leak could be in: EvoGallery / Jot / AjaxSearch / ForgotManagerLogin

_________________________

Edit, When a fresh copy still adds the AD then it must be a plugin or added in a template/chunk.

Evolution user, I like the back-end speed and simplicity

7 Posts

teco_aus Reply #14, 9 years, 5 months ago

Thanks for your response fourroses666.
I've moved the post to https://forums.modx.com/thread/97934/site-hacked---help-needed-to-remove?answer=529542. For some reason each time I tried to post, it repeated the original post.