Malware insertion

Looking for a bit of help, a couple of sites have been injected with malware with the followig script:



Ive made it a non url for obvious reasons.

however were having some trouble finding the source of the injections in our MODx insalls, so although we cannot find the code in the source, as far as we are aware its now clean, but Google says otherwise.

any ideas?

If your not running the latest version I would recommend upgrading, if you are running the latest version re download it from the modx site and upload all the files to overwrite the ones on the server ( I'm presuming you haven't edited the core code ;o) ) and dont forget to update all your passwords for FTP, manager and database

Doing that at the minute, ran virus scans and cleaned a few files but still being reported but its not present in any of the code i can see

Be sure to delete all files in the core/cache directory. The bad code may be in a cache file.

You could also search for that string in PhpMyAdmin through cPanel. That will search the entire database for it.

You'll also have to look for any extra files in your install in case the miscreant has left a back-door somewhere.

Thanks Bob, removed and recreated the cache now.

THe problem is i cannot find how the code is being injected as far as i can tell is its clear, no code in tempaltes, reinstalled all the extras and the like

Here's one way it could be inserted http://www.technicalinfo.net/papers/SEOCodeInjection.html

I can't say that I fully understand how this might be a problem with MODx, but I suppose extras like search could open such a hole.

Thanks for the advice all.