Where can I find the downloads from a previous versions? I would need urgent the v1.05

Hi All,

A MODx website I host is compromised, sadly the customer has never updated the website nor kept the original zip version of 1.05. For me it is the first time I hear from MODx so it might need a steep learning and some help. I would like to get the hands on the original v1.05 zip file to do a file compare and also to fix the infected files which have been deleted and I need them to upload to be able to do a decent update to the latest version.

I found this is the back-end.
MODx version 1.0.5
Release date Jan 19, 2011

I would also like to know if it is possible to update this version straight to the v1.0.15?
If I am correct is this version just the Standard Traditional one?
Is there a way to check this to be sure I am not going to break anything?

I can swap to any php version required, so that shouldn't be any problem.
Any help much appreciated.

You can download 1.0.5 here

You can update from 1.0.5 to the latest version (1.0.15) - as usual, backup everything and go for it

http://modx.com/download/evolution/previous-releases/

I am not entirely sure if upgrading to 1.0.15 first would be a good plan or not. Hopefully someone else can chime in on that.

Check each file one by one for exploits. Search "MODX hacked Evolution" or "MODX compromised Evolution" (Google is best for a full forum search).

Thank you all so much for the super fast response.

So straight from 1.05 -> 1.0.15 That sounds good.
Quite often you need to do a few versions between.

Thanks. [ed. note: nick57 last edited this post 11 years, 1 month ago.]

You can upgrade from 1.05 -> 1.0.15 but if the site has been compromised its very unlikely that will solve your problem as the hackers often add extra files to add back doors. You really need to secure the site before any upgrade

Hi Paul, I do understand that upgrading is not the solution, all I wanted to achieve is that the website keeps running clean for a short while, but your absolute right, that is exactly the worry I have. At least I have replaced the files with good ones and found a few not identified by Maldet or the enc64 script.
Found this hidden script:

I am going through each folder, but I would prefer to wipe the account and start from fresh, but as I mentioned before, this is my first experience with MODx, I hope there is something that I can export only the content, but still have not found something. Most CMS have content export.

Any advice is very welcome.

I found this article: http://dae.me/blog/1697/modx-evolution-removing-spam-links/

This website has same problem, can I remove that plug-in or will it break the website functionality.
[ed. note: nick57 last edited this post 11 years, 1 month ago.]

To my knowledge it gets injected directly into the DataBase

"Quick ManagerManager" doesn't exist as a plugin whereas "Quick Manager" or "ManagerManager" do

Go to the DB - look for your plugins table, example: modx_site_plugins

Before deleting anything do a DB dump, then delete the plugin

Go tto the manager, clear cache, clear browser cache and then take a look at the front-end - if all worked well the code should be gone

If you are going for the upgrade / update

Dump the whole server in a zip, download it and then delete everything on the server

Upload the new (1.0.15) or old (1.0.5) version and re-install using update, that way you can be sure that all of the files on the server are clean

After the install has finished you can upload the files that are missing, images, CSS, etc. That way you can control all of the files and ensure that nothing dodgy gets back on the server

@iusemodx, I followed your instructions, to delete all files and then update.

- Removed all files, left mysql db as is.
- Uploaded version 1.0.15
- Uploaded /public_html/manager/includes/config.inc.php
- run install, it comes with option update, followed instructions and left all boxes ticked.

But for no means I am able to get the TinyMCE to show up to modify the existing content.

In Elements, Manage Elements, Plugins it shows this version is active.

TinyMCE Rich Text Editor (22) - 3.5.11 Javascript WYSIWYG Editor

3 options are ticked in the System events, is that correct?

RichText Editor
OnRichTextEditorInit OnRichTextEditorRegister

System Settings
OnInterfaceSettingsRender

Would it be possible that there is something left in the MySQL Database?
Kind regards,

EDIT: I have found now 4 versions of TinyMCE, two of them are v4.01 and v4.02 and are infected, perhaps the hackers uploaded their own version and each time you edit something they are back in business. I would need to do a clean install on other test account to see what is in mysql db related to the TinyMCE editor. [ed. note: nick57 last edited this post 11 years, 1 month ago.]