UCJ users who are having encoded javascript added to their index page
 

More and more UCJ users are coming to me and asking about a script that embeds itself into their index pages. This script is being added by apache. Someone has hacked your server and replaced the httpd file. A quick fix is to modify the body tags by adding a space between the last character in the tag and its closing bracket.

This:

Becomes this:
Next, have your host recompile apache and reinstall it. Then copy that reinstalled file somewhere on your server so you can just copy it back if this happens again. Then, figure out how they got in and make sure you have read and complied with the UCJ security announcement pinned at their forum and in the news section of your UCJ admin.

Is this related to the recent security hole found? Been fixed for most people.. though I guess if someone was targetting your site they could make changes quickly.

Matt