MODx parse error - just looking for insight

A website I’m working on has recently started displaying an error I can’t explain / debug. I am looking for a shove in the right direction so I can solve this.

The website is http://www.markhamexecutiveoffices.com and the error displays at the bottom

Background info:

- There are only two people with access to the site, myself and another developer, neither of which claims to have modified anything
on the website since it was originally launched in May 2009, at which point this error didn’t exist.

- So, without any sign of changes to the site, this error just appeared one day recently, which doesn’t make sense, after many months of being online with no problems.

- The error references the strpos() function in PHP, which is not used anywhere in my template files or other code. I imagine that function is called in a MODx core file.

- The error also references index.php, which I checked and also does not use strpos() at all. This also seems to be a MODx core file that has not been modified by me or the other developer.

- I am curious if it has something to do with the web host changing, perhaps through some regular maintenance. It’s on a shared hosting platform with GoDaddy and I will be phoning them today to see if the PHP version this site uses has been changed, or anything else.

- Could another site on the shared host cause a problem with my website? I believe that’s quite rare.

- Oh, this is running MODx 0.9.6.1p2

- I have been Googling this problem and checking documentation, but can’t find a solution (obviously). I will continue to do so as I wait for responses to this post.

- I am available to answer questions ASAP, so please ask for clarification if it will help with my problem.

Thank you to anyone who is able to provide support!

I may be on track to figuring this out. It seems that an odd line of code has been inserted at the top of various files on my site, though I don’t know where this code came from.

<?php /**/ eval(base64_decode("... a really long string of gibberish ..."));?>

I will have to check with the other developer. I was previously searching for strpos() as the culprit, but when I started looking for eval() I found this. I would assume this problem can be considered resolved at this point, though I will try to post a reply when it definitely is.

The code in question is typically inserted on hacked websites. I suspect your site has been hacked so you may want to check things over closely and/or upgrade your install deleting any non critical files.

Thanks for the input. In order to apply this type of hack, a person would essentially have to have FTP access to the site then, no? In order to update the PHP files? Just doing another look I did find a file called "marie_quintana.php" in the root, which is obviously suspicious. It only contains that string I pasted in my last post.

What’s the point of this type of hack? Is there anything else I should be concerned about other than this code? Should I reinstall the whole MODx site from a backup to ensure I cleanse it of everything?