A URL Injection hides itself

You said you made a clean install, but did you delete all existing files first?

Did you also delete all the files in the cache folder before doing the install?

Does it happen if you visit the site in private or incognito mode in your browser?

Maybe some files below the root?
If I remember good I had some .php files in AWstats years ago.

Thanks for your replies.

I had checked "email me new replies" but the website has just sent me the replies. I am sorry for that.

What I did until now is:

1. I had made a completely new install on my localhost. I just installed the old database sql. The website looks without no css but the page was still there.

2. I am not an sql expert. I looked for the injection code, eval 64 or all the other stuff. Even I looked at the modx content tables. No luck for that.

2. Google webmaster tools warned me about the injection.

4. Also Acunetix found it.

They all told me about the page but I still cant find the injection code.

That is why I thought that sql injection. Also Acunetix reported as sql injection.

This sounds like what happened to one of my clients' websites, except that it happened to an installation of MODx Evo. Not sure how helpful this will be, but here's what I did to fix it.

1. Zipped my MODx installation on my server, then downloaded it locally
2. My antivirus (!) detected a folder called "buyvalium" in one of my older directories and flagged it.
3. I removed that directory via FTP
4. Then I looked inside assets/cache and saw a bunch of fishy files - assets/cache/1.data.php, 2.data.php, 3.data.php, 4.data.php, and 5.data.php. I deleted all of these.
5. I also found a mysterious Core Services plugin that I never installed, so I disabled and deleted that. After I deleted that, the pharma pages disappeared from my site (though they still exist to Google).
6. Also removed QuickManagerManager and ForgotManager plugins
7. Then I upgraded my MODx installation and changed my FTP and MODx passwords

Hope this helps... it's been a nightmare to clean. Also, make sure you remember to ask Google to Re-Review your site so that it removes the pharma pages from your site index.

http://forums.modx.com/thread/89564/warning-hacking-attack-on-revo-2-2-4-using-core-services-plugin?page=4 might be helpful too?