OpenCart Community

Ok...Im moving a site to a staging subdirectory to mess with it. After I moved the site - I noticed that all my images got replaced with image below.

There are no more images .....its just links to their xyz website.

Did I get hacked? I guess so. But the main site doesnt have this issue. So that is weird. Only the copy /pasted subdirectory I just created has this issue.
Is this database injection? Or ftp injection? I scanned the site with malware scanner but nothing.
Even if I press on little "HOME" icon from the admin site - I get linked to their website.

Can anyone help me to find the source. Did anybody ran into this before?
Thanks.
bts, htaccess looks clean.

It could be that your web host display a custom image when someone requests an image that doesn't exist.

Test this theory by browsing to www.yourdomain.com/non-existant-image.jpg

It cant be because when you are in the backend - and Click "show store homepage" it takes me to that xyz hackers site. That is why I dont knwo where the injection is.

doktorek wrote: ↑

Tue Aug 22, 2017 11:32 pm

It cant be because when you are in the backend - and Click "show store homepage" it takes me to that xyz hackers site. That is why I dont knwo where the injection is.

Can you send me the url of your store?

I was able to revert to last backup and make it go away. I believe it was a plugin I downloaded from the forum here.

doktorek wrote: ↑

Fri Aug 25, 2017 8:53 pm

I was able to revert to last backup and make it go away. I believe it was a plugin I downloaded from the forum here.

Great