The DNN site that I have set up for a friend has apparently been exploited. One of the modules in the home page is adding what appears to be a malicious script. I've scanned all the site files with no match so I image the exploit must be injected from the database. It is an HTML Module but when I go to edit the content of the module I do not see the script. I imagine that the module itself is injecting the script but I'm not familiar enough with DNN to know where the content might be stored. Here is the Module output (edited down for brevity). Would anyone be able to tell me where I might find this so I can remove it?

<div id="dnn_ctr424_ContentPane" class="BlackTitleContentpane">

        <!-- Start_Module_424 --><div id="dnn_ctr424_ModuleContent" class="DNNModuleContent ModDNNHTMLC">

            <div id="dnn_ctr424_HtmlModule_lblContent" class="Normal">

               [...HTML Content..]

            </div>

        </div>

        <script type="text/javascript">[Malicious Code]</script><!-- End_Module_424 -->

    </div>

So, right after posting this I was able to fin it myself. I figure that I will keep this here just in case someone else runs into this. The script was in the footer of the dnn_TabModules table. Since none of my modules had any footers I was able to run this SQL command to remove it though I imagine I could also have done it via the editor on the site.

update dnn_TabModules set footer = NULL where footer is not null

Here are some signatures of the malicious script.

function tnaq()
function szez(a)
fkhu=window["eval"]("eval")
ykra='fromCharCode'