I'm the webmaster (inherited the site from the developer) for a site called kenbrook.org. The site is currently being tagged as malware infected by Google, and gives the following details: http://www.google.com/safebrowsing/diagnostic?site=kenbrook.org

Sadly, this is the second time it has occurred. I posted the issue when it happened last year originally on Stackoverflow on this post, shortly after I inherited the site. At the time the fix was a simple removal of a few lines of code from a .js file, but I never did discover or resolve the vulnerability.

The site is built on MODX, which neither I, nor the original builder, have any familiarity with. I've tried to check for security updates from MODX, but updating that software has been a real pain also.

Sooo...what's my next step to getting this whole issue resolved? Or steps?

  • UPDATE: upgrading my version of the CMS seems to have resolved the issue. While I found no actual code in the markup that Google claimed to have found, the upgrade apparently addressed the security vulnerability, and Google has un-tagged the site as malware. Thanks! Mar 11, 2011 at 14:01

3 Answers 3


That's an old version, you definitely need to upgrade. MODx doesn't have a one-click upgrade like WordPress. What you would need to do is download the latest version of Evolution, in your case at this time it would 1.0.5, upload it via FTP and overwrite the existing files, and then run the installer again, selecting "Upgrade existing install" and making sure to not install the sample site.

One suggestion I have is make a local copy of the site and trial the upgrade on that before doing it on the live site, so you can make sure it works.

Make sure that before you do all this you've backed up your files and your database. The only sticky point here is you don't know if the original developer modified any of the core files/snippets, because those changes will be overwritten. If it's possible to find out before upgrading then that's better. But doing a trial upgrade on a local copy of the site and then checking the upgraded site thoroughly may alert you to any such issues.

  • So how on earth do I overwrite the existing files without deleting all of the custom content? (CSS, markup, etc?) Mar 8, 2011 at 3:12
  • The custom stuff that was added to the site will not be overwritten. In most cases the CSS and images are added on as new files after install, and therefore when the new version is uploaded, they remain untouched since there's nothing in the upload to overwrite them. What will be overwritten is what's in the core, the core snippet files etc.
    – user5917
    Mar 8, 2011 at 3:53

What version of MODX are you running?

I've been using MODX for years now and I honestly have no idea what can be a pain about updating.. simple overwrite all of the MODX files, and run the installer selecting "upgrade".

In older versions (which seems to match your description of "last year" and finding updating hard to do) of MODX Evolution (1.x) some addons which are included in the package contained security holes. These are the reflect exploit, and one linked to ajaxsearch in one way or another.

They have been fixed a long, long time ago but sites are still being targeted with it even if they are running different versions featuring many functional and security improvements. Your best bet is to simply upgrade to the latest (1.0.5). If you're having trouble with that, please visit the MODX Forums and request help there.

  • It is version Where do you upgrade from? In Wordpress upgrading is a simple one click operation from the dashboard. Where do you go in the manager to upgrade MODX? Mar 8, 2011 at 2:39

Infected code? I would save CSS, pictures and content and startover in the latest release.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.