Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site that appears and works fine.

However if you search for it in Google a whole lot of other links come up, eg:

mysite.com/kamagra-viagra.html

Clicking this I get redirected to the Kamagra site.

I have scanned my site for viruses and cant find anything.

I am using the ModX Evo CMS.

Can anyone suggest a particular file I should be looking for that causing this?

EDIT:

I have noticed some strange Javascript in my header:

<script type="text/javascript" src="http://www.mysite.com/home.html?getjs=metric.js"></script>
<script type="text/javascript">var j1s = document.createElement('script');j1s.type = 'text/javascript';j1s.src = 'http://www.mysite.com/home.html?getjs=metric.js?getjs=metric.js';var h1ead = document.getElementsByTagName('head')[0];h1ead.appendChild(j1s);</script>

This is not in my template file, but appears when the page is loaded. I suspect this is the issue.

share|improve this question
    
check your htaccess file on root it may injected with some codes. – Jobin Jose Jan 29 '14 at 5:07
    
Good idea would be to update to ModX revolution. You'll get a better CMS and likely lose the malicious code. – Steve Feb 28 '14 at 6:21
    
Are you using wordpress? – vDog Mar 30 '14 at 7:07
    
If you are using wordpress. It may be because of a plugin or the theme that you use. I had the same problem and I relaunched the website with new theme and tested plugins. It worked. – Indrajith Indraprastham Mar 30 '14 at 10:24
    
@MeltingDog: Did you fix the problem? was the given answer useful? If you found a solution, you can post it here to help somebody else – PatomaS Mar 31 '14 at 6:10

There are tons of possibilities. Your .htaccess file may be compromised and a redirect statement is being evaluated to send users away but that's a fairly blunt hack and easily found and fixed.

More likely is one or more of your CMS core files has had obfuscated code injected and that code runs on each access to both produce spam links for Googlebot consumption and also injects a JavaScript to send users away. The trick here is figuring out which file has been altered and how the attackers gained access and that process can be very difficult for non-security trained people to do.

Also a possibility is that the database containing the site content has been compromised and malicious codes injected there. This can be fatal to a site if you don't have proper safe backups of your content.

In any event, there are two basic questions that arise from a careful reading of the above scenarios:

  1. How did they get in?
  2. What did they change?

With the obvious follow-up being "How do I fix it?"

Unless you have a lot of experience diagnosing and fixing security problems, you may want to leave this to a professional. There are consultants who will do this as well as subscription-based services such as Stop The Hacker or Sucuri.

share|improve this answer

This is a hack that seems to have compromised several MODx Evo out of date installations. I've just fixed one, this is what needed doing:

  1. In the MODx Manager, go to Elements > Manage Elements > Plugins > "Quick ManagerManager".
  2. Search for the code @eval(@gzuncompress(@str_rot13(@base64_decode(
    (I found it near the bottom of the file)
    • This is the encoded malicious code, which causes the metric.js script to be inserted into the top of your home page
  3. Remove this very large line and click save.
  4. Now go to Plugins > "Highlight Search". This whole plugin seems to have been inserted by the attack.
    • This causes the urls like /best-website-kamagra on your website to redirect to another site. I found it by searching the database for str_rot13.
  5. Delete this plugin.
  6. Go to Elements > Manage Files > assets directory, and delete the 'cache' directory.
  7. Upload a clean assets/cache directory from the MODx Evo distribution.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.