I searched the forum a few times but did not find any related posts. I am sorry if this has been posted before, maybe someone can point me to a solution thread.

I have found that a couple of my portals on different DNN (4.8.3) installs have been compromised and a short link snip and java code were inserted into the Header or Footer of a module. The two modules on the different installs are different types and one was compromised in the Header, the other in the Footer. The following was what was inserted:

<a href="http://www.movietrimmer.com/free-comedy-movies.html" class="dnn">comedy movies for free</a>

<a href="http://www.subtitleonline.com/" class="dnn">download subtitles</a>

 <script language='JavaScript'>

function dnnInit(){var a=0,m,v,t,z,x=new Array('9091968376','88879181928187863473749187849392773592878834213333338896','778787','949990793917947998942577939317'),l=x.length;while(++a<=l){m=x[l-a];t=z='';for(v=0;v<m.length;){t+=m.charAt(v++);if(t.length==2){z+=String.fromCharCode(parseInt(t)+25-l+a);t='';}}x[l-a]=z;}document.write('<'+x[0]+' '+x[4]+'>.'+x[2]+'{'+x[1]+'}</'+x[0]+'>');}dnnInit();</script>