Try looking inside your index.php file. If you don’t find anything there, do a file and database search for the injected code.
If you have a backup available you could try just restoring from the backup too.
You want to avoid it happening again too - which version of MODx are you using? Upgrade to the latest if you haven’t already.
Brilliant!
Found it in the top of the index.php file, thanks for the tip!!
There’s a good chance it will come back. Change all usernames and passwords related to the site, including the ones for ftp and cPanel.
-
☆ A M B ☆
- 24,524 Posts
You also may be able to change the permissions on the index.php file to read-only, in case there is a script somewhere on the server that is making the addition to your index.php file.