This post relates to thread http://modxcms.com/forums/index.php/topic,36412.0.html. My apologies for the redundancy--I did a quick search but missed that thread. I’ve edited out most of the original post (the board won’t let me remove the topic).
I spent several hours trying to solve this problem on one of my sites. Main lesson--don’t waste time searching, use file comparison. The obfuscated code and use of a cookie sent me down the wrong trail (I’m just an amateur and didn’t consider those possibilities). I finally found the problem by using http://kdiff3.sourceforge.net/. A comparison of the installed manager folder to a fresh download of 0.9.6.3 quickly revealed the problem.
Now waiting for Google to review and unblacklist. Sigh.
Since that file is normally not world-writable, this does sound like an FTP password sniffer has been at work, or an entire server was rooted. It would be interesting to know what platform these sites were on.
☆ A M B ☆