Help! Badware getting injected into my clients site!

Hey Everyone,

I have a few clients still running MODx 0.9.6 which I am in the process of upgrading to Evolution due to the fact that, one by one, my clients are falling victim to some type of badware injection. Most of them I have been able to find within the code and get rid of, but I am having trouble finding this latest script and I need your help.

This javascript



is appearing in the "head" tag between the "ajaxsearch" script and the CDATA javascript and I can’t find where it is getting injected from. Can anyone give some ideas of where to look?

The whole "head" tag is attached to this post as an image below to show you where it is appearing is.

Any help in getting this site cleaned up would be appreciated.

Thanks,
Bryan

Until you upgrade, chances are it will get re-infected.

Yes, I know. I am upgrading, but I did not want to upgrade until I removed the existing infection. But, I can’t seem to locate the script in any of the usual places like "templates" which is where I usually find it.

Does anyone have any ideas of where to look. I have look in the database for the injected code and can’t find it there either so I am assuming it was injected into one of the js files or include files. Since it is being inserted between the two MODx javascripts I am assuming at this point that the bogus script is in one of those files but I don’t know where they are located or understand how MODx assembles the page during presentation.

Will upgrading simply overwrite the file that contains the badware?

Bryan

Disinfecting from a hacked site is not always a formulaic process. Usually protocol here is to nuke EVERYTHING back to a known-good state. That means reinstalling all plugins, all snippets, and every file on the server. The idea is to put up a fresh install and copy in only your content after carefully preening it.

If there is some insecure PHP or Javascript library that you’re using (e.g. the phpThumb vulnerability), however, chances are good that your site will be hacked again. The security hole may even be within your MODx install (e.g. if someone figured out your manager password) or within your web host.

1. Do a completely fresh install.
2. Reset ALL passwords for all users. Do not use passwords that easy to guess. Make them F’ing hard. This includes MODx passwords, MySQL passwords, and any passwords used to log into your web host.
3. Delete/remove any unnecessary users from the installation (including FTP, email users... clean the cruft)
4. Remove any unnecessary files from the web server.
5. Copy your content back into your MODx install, carefully checking it for any injected code.
6. Check security bulletins to see if there are any notices about your software (e.g. MODx, plugins, etc) that have experienced exploits.

That’s the big stuff. After that there are lots of other things to do to improve security incrementally, but there are no guarantees that you will be hack-free.