MODx 2.2.14 Install Zip Contains a Virus?

I recently experienced a crash of a new MODx install done with Softaculous. Had been working for a few days without issue, and then, kaboom! Manager locked up and unable to login. I now receive the following error when attempting to log in to the manager:

Warning: array_merge(): Argument #2 is not an array in /home/mysite/public_html/core/model/modx/modx.class.php on line 2412
Fatal error: Class 'modContext_' not found in /home/mysite/public_html/core/xpdo/xpdo.class.php on line 770

Now trying to do a new install over the previous install (same versions 2.2.14) and the cPanel File Manager fails the upload and states:
FAILED! :The file modx-2.2.14-pl.zip you uploaded contains a virus. The upload was canceled. Servname not supported for ai_socktype

Not sure how to proceed.

Where did you get the copy of 2.2.14 that CPanel wouldn't upload?

I got the copy from the MODx site.

My issue was resolved at least for the MODx site when the host support deleted the contents of the core/cache. After that, I was able to once again log in to the manager and everything seems to be functioning well. Though, my confidence is a bit shaken.

There is no virus in the zip file. I just specifically ran it through my anti-virus and it came out clean.

I just uploaded it to my own CPanel host with no problems. Which version did you download, traditional, advanced or sdk? [ed. note: sottwell last edited this post 12 years, 2 months ago.]

Well I can image a couple of reasons for whats happening,

It would be nice to have a look at that particular file. PM me a download link, so I can check it.

Until then, lets pretend we can be sure that MODX.com doesn't spread contaminated packages and the problem is somewhere else:

1.malware
There is a couple of software in the wild rewriting links. Most of them are browser plugins stealing affiliate links from blogs (this is a million dollar market, and a HUGE problem for honest bloggers). With the same kind of software it would be extremely easy to redirect you to a compromised file instead of the original one.

My advice: Check your computer for malicious software, especially browser plugins. Don't trust your virus scanner. If you are a mac user, don't fall for that "there is no malware/virus problem for mac" propaganda.

2.cpanel
which version of cpanel are you running? I have seen servers running versions that were written about the same time the wheel was invented. The message might be a false-positive caused by some ancient security routine.

My advice: Check your hosting. Especially have a good look at version numbers for phpmyadmin, cpanel, php, mysql. If there is a lot of dust on top of these important packages, ask for an update. If you don't get it find another place to host your page.

Regards,

pepebe
[ed. note: pepebe last edited this post 12 years, 2 months ago.]

Update: I installed the latest version of VirusBarrier and ran a scan on the MODx zip file: No virus found.

Thanks for the response. I've doubled checked my php, mySQL, and cPanel versions and all appear to be current. (cPanel: 11.44+, php: 5.4.27, etc.) Should be up to snuff. I suspect some kind of server issue that corrupted MODx. Clearing the cache manually seemed to resolve it, and good to know that I can do this with the File Manager.

Can't explain not being able to upload the MODx install zip to the server though. May give that a try again today to see if it still gets flagged.

Will also be running a full virus scan on my Mac, but will do that overnight.

[ed. note: mmcgee last edited this post 12 years, 2 months ago.]