Page 1 of 1

All images got replaced with HACKED link ...how to fix?

Posted: Tue Aug 22, 2017 1:35 pm
by doktorek
Ok...Im moving a site to a staging subdirectory to mess with it. After I moved the site - I noticed that all my images got replaced with image below.

There are no more images .....its just links to their xyz website.

Did I get hacked? I guess so. But the main site doesnt have this issue. So that is weird. Only the copy /pasted subdirectory I just created has this issue.
Is this database injection? Or ftp injection? I scanned the site with malware scanner but nothing.
Even if I press on little "HOME" icon from the admin site - I get linked to their website.

Can anyone help me to find the source. Did anybody ran into this before?
Thanks.
bts, htaccess looks clean.

Re: All images got replaced with HACKED link ...how to fix?

Posted: Tue Aug 22, 2017 4:57 pm
by paulfeakins
It could be that your web host display a custom image when someone requests an image that doesn't exist.

Test this theory by browsing to www.yourdomain.com/non-existant-image.jpg

Re: All images got replaced with HACKED link ...how to fix?

Posted: Tue Aug 22, 2017 11:32 pm
by doktorek
It cant be because when you are in the backend - and Click "show store homepage" it takes me to that xyz hackers site. That is why I dont knwo where the injection is.

Re: All images got replaced with HACKED link ...how to fix?

Posted: Tue Aug 22, 2017 11:43 pm
by webcorvo
doktorek wrote:
Tue Aug 22, 2017 11:32 pm
It cant be because when you are in the backend - and Click "show store homepage" it takes me to that xyz hackers site. That is why I dont knwo where the injection is.
Can you send me the url of your store?

Re: All images got replaced with HACKED link ...how to fix?

Posted: Fri Aug 25, 2017 8:53 pm
by doktorek
I was able to revert to last backup and make it go away. I believe it was a plugin I downloaded from the forum here.

Re: All images got replaced with HACKED link ...how to fix?

Posted: Fri Aug 25, 2017 8:55 pm
by webcorvo
doktorek wrote:
Fri Aug 25, 2017 8:53 pm
I was able to revert to last backup and make it go away. I believe it was a plugin I downloaded from the forum here.
Great ;)