Hacked website

They are cached pages in Bing but am not sure how the link forwards to the viagra site. As when I hover over the link it says www.lyonsdown.co.uk/levitra-vs-viagra-uk.html but when I actually click the link it goes to some viagra site.

Quote from: [email protected] at May 13, 2013, 06:06 AM

Hi

When I find the link in google. by typing in lyonsdown viagra there are lots of rogue links then when I click on them they just forward to the viagra page. I am not sure how to actually remove them from

The only way to get them removed from Google/Bing is to remove the links from your own site then wait for Google/Bing to re-crawl the pages and update its index/cache.

Once you've removed the links you can push Google/Bing to re-crawl your site faster by submitting a new sitemap etc, but basically you're at the mercy of how fast Google/Bing will re-visit your site once the pages are clean of dodgy links.

For links on other people's sites..... you either have get them to remove the links, or if you clean up your own site, hopefully search engines will realise their links point to now non-existent pages on your own site and start to ignore them.

I would say it's a slow process and if anyone offers to do it quickly for a fee, they're probably not that genuine. [ed. note: absent42 last edited this post 13 years, 5 months ago.]

I had an idea that I could reinstall modx and create a new instance of it on our server and then reinstall the site from a backup before it got infected. Do you think that would solve the problem?

Quote from: absent42 at May 09, 2013, 10:14 AM

There's also spam links at the bottom of most pages just before the closing body tag:

<div style="position:absolute;left:-2311px;top:-2794px;"><a href="ht(*breaking the link*)tp://www.ramada-fried(*breaking the link*)richroda.de/viagra-italien-rezeptfrei">viagra jetzt rezeptfrei</a> <a href="htt(*breaking the link*)p://www.ramada-friedric(*breaking the link*)hroda.de/viagra-problemlos-kaufen">viagra problemlos kaufen</a></div>

In your htaccess is there any auto_prepend_file code?

How to clean up those spam links:
http://d43.me/blog/1697/modx-evolution-removing-spam-links/

Hello Dae
that is most helpful.
How do I replace the assets/cache folder ? Can I just delete the info in this folder?

You can delete the "cache" folder entirely and then reupload a new one from the MODx distributive. (Don't forget to set read and write permissions after uploading).

Login to Manager > Elements > Plugins

IF You might see "base64_decode(str_rot13" anywhere in a plugin

Right click to select "deactivate plugin". Clear the site cache (site > Clear cache). Check if your issue is resolved. Go back and delete the plugins.

For me the following were compromised.

-Highlight Search
- xPDO Compile

Once somebody gets a login, then they can install any plugins or snippets they want. Keep a log of what plugins, snippets, chunks, templates and TVs you are using.