Google Reporting Malware

[green-lantern]

Dont trust jim!

[Jimvr4]

Should be good to go now.

[Jimvr4]

Site is normal now

[Alan92RTTT]

All set.

Might want to look into that and see if you can find how it happened.

The one time it happened here is when it was on shared hosting and one of the other sites was hacked.

[Jimvr4]

All set.

Might want to look into that and see if you can find how it happened.

The one time it happened here is when it was on shared hosting and one of the other sites was hacked.

Well, I took a good look at the site and I did find a bunch of stuff I didn't put there. Most of the weird files were posted up on 12/13. I had a weak password into the http documents manager so I fixed that and deleted about 30 unknown html files and one folder that had unknown html and javascript. I submitted the site to google for review now. Thanks guys and gals

Probably can't find out anything further. All my car stuff is on a subdomain and that part was clean. The main domain had issues and I pretty much never looked at the files so I don't know how they got there, just the dates that were posted. After regenerating the files that belonged there it was pretty easy to see what was added.

[Hans@GZP]

My site shows it on some people's computers, yet is fine on any computer I go on. I'm on shared hosting as well... and certainly don't know enough of this html talk to figure out what is going on.

[Jimvr4]

Looks like my troubles returned. Someone put some JS into my main page on 12/26. I've changed my FTP password but I have to wait until I get home to make corrections to the site and re-certify it with Google.

[Alan92RTTT]

You may want to check with your host and see if they can help you find the source of this.

[stealthify]

Check your personal computer for malware as well, Jim. I've had a client that kept getting JS added to his site because his personal computer was compromised, essentially making it easy for the bad guys to get his FTP password and do as they pleased.

[duke3k]

Jim,

Dont forget to check and verify that directory & file permissions starting with your www/html_public root directory on down are locked down. if they get modified to anything above a umask of 755 then that can be a security hole open so they wont need yourftp account -they can just use anonymous access.

duke3k