It looks like this bug has been fixed:
To be clear, if you have the Core Services plugin, your site was compromised and there are going to be remnants and malicious files that cause other issues. In all likelihood, there will also be a malicious user added to the Users. See the following MODX Cloud support document as it will help you clean up your site: https://support.modx.com/hc/en-us/articles/360009725154-Detecting-and-Cleaning-a-Hacked-Website
Running that malware scanner seems to return a lot of files. How do we weed out the false positives.
Like the first result says:
nano -cl$ +3282 /ROOT/core/packages/core/MODX/Revolution/modContext/9e783179b7b78234093f6f977002ebde/0/assets/fileapi/FileAPI.js
If I look at line 3282 in the file it is:
}, _complete/*error*/);
Surely that is not malware.
Typically, a quick head of the files that you don’t recognize is a good way to check for good files. But caution, the Core Services hack did have self-creating files with bad file names that also inserted thousands of spaces so scrolling through a file could not be easily detected. Good files will not be likely that way. Most valid files, if not all, will have code starting at line 1.
Further to that, I’d also note, I’ve never seen any bad files in the core/packages/dir with the expected package naming format as above.
This topic was automatically closed 2 days after discussion ended and a solution was marked. New replies are no longer allowed. You can open a new topic by clicking the link icon below the original post or solution and selecting “+ New Topic”.