|
Change your FTP password, remove the script at the bottom of the page that runs the iframe:
[code=trojan stuff on your pages]
<script language="JavaScript">
e = '0x00' + '22';str1 = "%99%C1%CA%
blah blah blah
</script>
[/code]
You might have your host run a check to see what other files were modified at the same time. Pattern to look for is:
Login, Get File, Put File, Get File, Put File, Logout
usually no failed password attempts.
Sources for your password leak: People that have installed software for you in the past, anyone that has had FTP access to your machine, possibly any keylogger on your system.
The script forces the installation of an "start.exe" which connects to a site hosted at "inhoster.com". I donīt think itīs worth to contact them if you have a look at their site.
The site called us-counter.com and dnv-counter.com belong to a guy from Ukraine and are blacklisted with several records. IPīs from the sites and from the hosting company are pretty much the same.
|