Popup message on Android Phone

I'm not sure if this is the correct place to post this question but I am at a loss to know where to go :-(
Using Modx revolution 2.2.14pl

Everything works fine but I am having a problem with Andriod phones - at least that is the only device on which I am aware of the problem occurring. I don't know whether it is Modx related, server related, phone related or where it is coming from. I have run a malware app on the phone but nothing is found. Another android phone gives the same message.

When I access pages on the site using an Android phone I get a popup which says:
The page at "http://qpgc.com.au" says:
Warning! You must update web browser! Upgrade now?
There is a CANCEL button and an OK button.

Clicking the OK button sends to a blank page with the URL: apps.rumobi.info/SH3Sh

I have located some apps for Iphones which use a similar URL but not for Android.

I have not used a special mobile theme.

Could anyone shed some light on what may be causing this? I have searched the web but am unable to come up with an explanation.

Thanks

First thing I notice about that page is that you should check it with the W3C validator and clean up the validation errors. It's harder to examine a page's HTML to see if there's anything odd there when there are so many errors.
http://validator.w3.org/check?uri=http%3A%2F%2Fwww.qpgc.com.au%2F&charset=%28detect+automatically%29&doctype=Inline&group=0

Is this a fresh installation of Revo 2.2.14, or an upgrade from an earlier version?

While the page needs to be examined for any Javascript that you didn't put there, let me say that I am not getting any such popup on my Android phone from here (Israel).

A few weeks ago I was in Tel Aviv with a friend, and every page we tried to access was popping up something similar. I changed our computers' default DNS servers to use Google's DNS servers instead of those provided by the ISP there in Tel Aviv, and everything was fine. Here in the south of the country where I live, using a different ISP, I never did have the problem. So your problem may be something similar, poisoned DNS servers or caching proxy servers at your local ISP.

Well... at any rate I wasn't getting the popup. Now I am. But it does look exactly like the same popup I was getting a few weeks ago.

Is this something you have in your templates?

Ok. Here's your problem. https://forums.modx.com/thread/85986/modx-revolution-2-2-6-hack-appearing-in-assets-folder

The first thing to try would be to download a reputable anti-malware app for the phone. Google the name of the app before installing it. Some of the anti-malware apps actually install malware.

FYI, never click OK when you see an unexpected Android popup. You could be authorizing the installation of an app that with a key logger that will steal all your passwords.

I don't see anything obviously suspicious in the source code of the page. Since you don't have any mobile-specific code, anything bad should be visible in a PC browser. Also, I'm not seeing any popup when I visit that site with my Android phone. That suggests that both phones you tried may be infected.

Resetting your phone is also not a bad idea at this point.

You definitely have the assets/cache.php file on your server.

Thanks Susan and Bob.

Ok. Here's your problem. https://forums.modx.com/thread/85986/modx-revolution-2-2-6-hack-appearing-in-assets-folder

Yes - it looks like I'm not the only one.

The cache.php file was there - now removed, but the popup continues to appear so it has obviously infected things.
Further reading the above thread and I found the infected file - now removed it has resolved the issue. Now to try and find how it has happened - and repair those page errors

Thanks for the help

[ed. note: bobd72 last edited this post 12 years, 3 months ago.]

This is the offending code:



I'm not sure how it's getting there, but check your Templates to make sure it's not there.