Script injection on .cfm pages

Thanks for the great leads everybody.

So it really sounds like the preferred method of entry here is compromised FTP accounts? The server I'm hosting my websites on is a VPS solution and only has a handful of FTP accounts. For the time being I've disabled those accounts, and enabled logging for the FTP server. Once things are cleaned up, I'll restrict the ftp accoutns to the user IPs. Please, keep the information coming - this has been really helpful.

This problem is necessarily caused by modification of the server-side script files.  Therefore, it is necessary that the server must have been compromised.  On a shared server, this is "more or less to be expected," since hundreds if not thousands of people other than yourself have accounts on the same server(s).  However, there is a lot that you can do to preven it:  it only takes a couple of extra steps.

1. Always use sftp (secure FTP) to transfer files and to establish host sessions.  Many hosting companies allow you to disable non-secure FTP, and you should do so.
2. Protect your username/password as robustly as you can.  "password1234" is an extremely common password, as is "password." 
3. After transferring files to your computer, use chown (Unix), cacls (Windows), or its equivalent to secure the files against anyone, including yourself.  (You can always countermand your directives later, the next time you're ready to update the site.)  This will at-least require the intruder to have compromised your account, not someone else's.
4. In that same vein, don't forget to secure all of the parent directories!  "It'll do no damn good at all" if the intruder can replace your carefully-secured directory, in its entirety, with an altered one!
5. Make backups!
6. If your site permits any sort of user-contributed content to be provided, make absolutely sure it is well-filtered.
7. "Think like a pirate."  ("RRRRRrrrrrrrr!!")  Web-site compromises are always "crimes of opportunity."  Many a cat-burglar has made a good living by trying each door in a neighborhood while carrying a pizza box.

My experience is that the attack happens because some developer

machines are compromised: a trojan on the developer machine can

"steal" FTP usernames and passwords, connect to the FTP accounts and

modify the files.

Check your FTP logs for modifications to the files, change the FTP

usernames and passwords for the site, scan the computers that are

making FTP connections to the site.

Mack