Site Hacked. AD inserted at bottom of page - My Forums

Site Hacked. AD inserted at bottom of page

zerograv — Apr 22, 2013, 10:49 PM

I have an EVO 1.0.6 site and an AD is being inserted just before the closing body tag. Below is the end of my footer chunk that is the last thing pulled into my template. The AD is being inserted between the closing paragraph tag and the closing body tag.

The ads div has absolute positioning that pushes it off the top-left of the page. I downloaded a fresh copy of 1.0.6 from the MODX site and took a dump of the database. I uploaded these along with my template files to a different shared hosting account but the ad still appears.

I am really at a loss as to how to track this down and remove it. Any suggestions would be greatly appreciated!

Re: Site Hacked. AD inserted at bottom of page

teco_aus — Aug 06, 2015, 05:40 PM

Thanks for your response fourroses666.
I've moved the post to http://forums.modx.com/thread/97934/site-hacked---help-needed-to-remove?answer=529542. For some reason each time I tried to post, it repeated the original post.

Re: Site Hacked. AD inserted at bottom of page

fourroses666 — Aug 06, 2015, 03:22 AM

You need to upgrade your version, else it will keep being hacked!

Could be a new plugin, check your template(s).
And clean up your FTP. Remove unused snippets.

As far as I know the leak could be in: EvoGallery / Jot / AjaxSearch / ForgotManagerLogin

_________________________

Edit, When a fresh copy still adds the AD then it must be a plugin or added in a template/chunk.

Re: Site Hacked. AD inserted at bottom of page

teco_aus — Aug 06, 2015, 12:42 AM

Re: Site Hacked. AD inserted at bottom of page

fourroses666 — Apr 26, 2013, 02:50 AM

// Maybe you downloaded a slider or other feature with the AD junk into the js? But on the other hand then you should have the problem now too..

Re: Site Hacked. AD inserted at bottom of page

zerograv — Apr 24, 2013, 03:57 PM

Thanks Guys! I changed everything. Including using a password generator to create a new DB name and DB user name. It's strange that when I did a test with a clean install of 1.0.6 the links still showed up but they didn't with 1.0.10.

Re: Site Hacked. AD inserted at bottom of page

smashingred — Apr 24, 2013, 03:45 PM

There were a number of serious exploits found in all versions prior to 1.0.8 that allowed all sorts of nasty things to be done. Fortunately it's not easy to find MODX sites like it is to find Wordpress sites.

Re: Site Hacked. AD inserted at bottom of page

BobRay — Apr 24, 2013, 03:39 PM

The odds are, the attack was file-based and you've deleted the evil file(s). Be sure to change All your usernames and passwords (MODX login, FTP, DB, DB User, cPanel) or you may be re-infected.

Re: Site Hacked. AD inserted at bottom of page

zerograv — Apr 24, 2013, 12:12 AM

Just to make things stranger... On a whim I tested uploading a copy of 1.0.10. This was a clean upload, not overwriting 1.0.6. I imported the SQL dump from my infected site into an empty database and tweaked the settings that needed to be changed. Opened the site in a browser and the ad links are gone!! I repeated the same process on my live site.

Put up a maintenance page
deleted everything including the database
uploaded 1.0.10 and the htacess and config files
imported SQL dump from the infected site to a new, clean database
Ran the install/upgrade
Tweaked any settings that needed to be changed in the config.
Loaded the site and no links!!

I have no idea what I did and how it worked but the links are gone and I'm a happy camper. My site had been tumbling down the rankings. Now I know why.

Re: Site Hacked. AD inserted at bottom of page

zerograv — Apr 23, 2013, 12:03 AM

I had the feeling upgrading wouldn't remove the ad. I've looked through my template and all the chunks and can't see anything that might be pulling the code in. Is there somewhere else I should be looking other than under "Manage Elements" in the admin?

It's weird that it is showing in the middle of my footer chunk.