-
☆ A M B ☆
- 24,524 Posts
Your site has been hacked. That is a very old, insecure version of MODx.
http://d43.me/blog/1697/modx-evolution-removing-spam-links/
Thanks for the reply Sottwell. Yeah I know it is very old version. I will have to tell my client to upgrade after this is fixed. From the article it looks like that the hack got implanted in quick manager plugin. I checked the plugincode but could not find the hack there. Is there any other content table where the hack could have been implanted?
-
☆ A M B ☆
- 24,524 Posts
It could have been implanted in any number of files, from the index.php to the manager/includes/config.inc.php file, or in any of the plugins. You'll need to search the file system and the database for any code like what was described in the article.
-
☆ A M B ☆
- 2,213 Posts
You should really examine every file on the server to ensure there are no backdoors involved. I've done quite a few compromised site recoveries and found multiple backdoors in other files. It's long and tedious, but if you want to avoid being re-hacked critical. You can accelerate the process some with different tools, which is what I've done in the past with good success.
Don't forget you also want to check the server logins to ensure that wasn't compromised as well
