Hi Linda, Paul is right on, any fix you do is likely a temporary one until the hack is triggered again.
My site administrator had this issue in a never updated 1.5.3 last year. The site admin spent lots of time undoing "our ru friend's" work every month or so, with a higher authority giving us reminders that we could not have hidden viagra links on our pages. As I recall, anywhere from 30 to hundreds of links in the header of every page, which linked to another poorly secured moodlesite in China that had ads and more links. Not pretty. Now we are 1.9.7, problem solved for now.
From my perspective, the good news is that "our friend" caused us update!
Sympathies and good luck,
Chris
Security and privacy
Ads underneath course offerings
This discussion has been locked so you can no longer reply to it.