Wierd sizing issue

[fwtools]

Hello I have been maintaining a website and it has been working fine. However last night the sizing got real wierd. I have not messed with anything to cause the problem( I haven't even logged into the admin settings lately). I have tried it on multiple computers and it is still the same. I know that it is hard to explain in words so here is a link. http://fireworktools.com/

I am using Zen Cart v1.5.0

[stevesh]

Someone has inserted some script at the very top of your site, which doesn't allow your stylesheets to take effect. You can use the Admin - Tools - Developers Tool Kit to search for refireads to find the file it's in. If you didn't add that script, it's possible your site has been hacked.

[kobra]

It is also causing your site to be in an iframe

[fwtools]

I think I fixed it. It does look like it did get hacked. That script was in about 25 files. Thanks for the help.

[stevesh]

If you haven't discovered where and/or how they got in, they'll be back.

[fwtools]

I am working on that but so far no luck. It also appears that they had done something else as I am now getting numerous reports of virus warnings. I had recieved a few logging into the admin side but none on the main site itself. Any ideas where to start folks? Also feel free to move this to the hacked thread if need be.
Thanks

[kobra]

Follow these steps
http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

Also check your local PC for any intrusion/viruses - you might try
http://housecall.trendmicro.com/

Once you are positive you are clean - change all your passwords

[lhungil]

You might start with Recovering From Hacks. Your hosting provider may be able to help determine how the site was compromised and help stop the site from being compromised in the future. If you or the hosting provider have known clean backups for the files and database those will come in handy for recovering.

If you are on shared hosting the attack may not have been directly against your website - but against another site on the same shared hosting server... You may want to run some malware checks against any computer used to upload files to web server or the admin interface just to make sure your own systems are clean...

If the intrusion method can be determined, it would be interesting to hear what the attack vectors were and how the perpetrators got unauthorized access to your site.

Note: Just saw Kobra's response - beat me to the answer ;)