Solved: Revo site infection problem after not updating

Hi, client never thought he needed updates, now on his page, http://www.hosteltralalasalento.com/rooms.html, there s viagra links. Below the footer and moved some 2000 px to left pos absolute. I changed his contract, good for me, now need to find out where I can find that bit of code? Is that directly in the database? [ed. note: franklos last edited this post 12 years, 4 months ago.]

Probably not in the database, most likely in the index.php file, or possibly the config.inc.php file. Check your user list for a suspicious-looking user name, and change the usernames and passwords for all of your Manager users.

There also may be some odd .php files; you can look at the dates on the files and usually see the ones that are newer than all of the others if they are suspicious. Also check the modified dates on the files, to see if any other MODX files have been changed.

Well, that's your problem.

https://forums.modx.com/thread/89564/warning-hacking-attack-on-revo-2-2-4-using-core-services-plugin

Recommended to read the whole thread, there appear to be some files involved as well as the bogus plugin and user.

Solution was to delete the bogus "core-services" plugin. Changed user passwords etc, upgraded. And all seems okay now.