Hi All, My site was hacked (or so I'm told) and has been suspended as it was sending 100's of emails, SPAM I guess. I have been slack and only had Evo v1.0.05 installed, if I upgrade to v1.0.14 will that resolve the issue or do I have to root out the offending files?
[ed. note: muzzargh last edited this post 12 years, 3 months ago.]
Search for files called lang.php or logo.php containing code that looks like this ${"\x47L\x4f\x42\x41\x4c\x53"}["\x68u\x7
( or any files that contain code that looks like that.)
Delete them. Upgrade.
They may have left a back door though where they can get in again, in which case, you will need to wipe everything, change your passwords, restore from a backup before you got hacked, and upgrade straignt away.
you really must upgrade and delete all infected files.
look for .php files in the assets map.
you can also rename the folder manager and assets and upload the new version.
copy config.inc.php and all images and files you used.
always backup your site first (files and db)
Evolution user, I like the back-end speed and simplicity
-
☆ A M B ☆
- 24,524 Posts
I also had a previous client contact me to help with the same problem. I haven't managed their site for a couple of years, but I scanned their system and found three .php files with the same recent date (June 3), deleted them, upgraded their site and also deleted all unused users, and changed passwords on MODX as well as their CPanel, email and FTP accounts. So far there hasn't been any recurrence of the spamming.
In the logs the trigger came from 146.185.239.19
Hmmm, can't upgrade for some reason. When I try to enter xxxxxxx.com/install I just get a blank white screen?
Mayby it's because all(actually just most) of the folder permissions are defaulting to 700 after I extract v1.0.14?
