Sites compromised with extra SCRIPT code in index.php and JS files

I’ve just noticed that I’ve had several sites compromised with javascript inclusions on index.php in the site root as well as around 100 .js files within other folders.

I’ve been unable to locate how this has happened as the date on the files doesn’t relate to any web server logs.

I’m a little lost as to where else to look to try and find out how this has happened but I thought I’d post here just incase others have had something similar.

The sites that have been compromised are all running modx 1.0.4. My own sites are hosted on my own w2k server.

No sure where else to turn with this.

sample code

Seems I can’t prevent this from being reinfected. I’ve tried to track down how and where it’s coming in from but I’ve come up with nothing. What would be a good way to lock down my site and files to prevent re-infection as well as trying to trace how it’s happening?

Thanks all,

I suggest you start changing your FTP passwords. Then ,just to be sure, change your manager pass.

And if you are running widows make sure you have a good antivirus/malware program.

And never let ftp client remember your passwords. I had a similar problem with my site (made with Drupal) and realised that some trojan stole passwords from Total Commander ftp client. I’ve changes passwords, started using WinSCP and have no problem since then.

I’ve gotten the passwords chagned and it turned out to be a trojan attacking Filezilla. I can put Filezilla into kiosk mode so it won’t remember passwords. Thankfully it hasn’t reappeared for over a week.