Google Reporting Malware

[Jimvr4]

You may want to check with your host and see if they can help you find the source of this.

Yes I need to do this.

Check your personal computer for malware as well, Jim. I've had a client that kept getting JS added to his site because his personal computer was compromised, essentially making it easy for the bad guys to get his FTP password and do as they pleased.

My co-worker says FTP passwords can be obtained easily by snooping since they are stored in the clear. I'm going to check with the host if I can disable FTP entirely.

Jim,

Dont forget to check and verify that directory & file permissions starting with your www/html_public root directory on down are locked down. if they get modified to anything above a umask of 755 then that can be a security hole open so they wont need yourftp account -they can just use anonymous access.

duke3k

I don't think anomymous access is possible but really have to check with the host as to what vulnerabilities need to be closed off. I've cleaned up the files (which didn't affect the car portion of my site) and asked Google for a review. I've also established site ownership with Google and verified no one else has site management rights.

[stealthify]

My co-worker says FTP passwords can be obtained easily by snooping since they are stored in the clear. I'm going to check with the host if I can disable FTP entirely.

Have you been connecting via FTP? Or strictly SFTP?

Also, if your host makes it accessible to you, I'd recommend checking the FTP logs. May be some answers there.

[Jimvr4]

I called the hosting company. I'm on a legacy server that only supports FTP and it cannot be disabled by me. I can have them disable it but then I won't be able to publish any site updates from my website client. I could move the hosting but I think the cost will be a bunch higher than the $4 / month I'm paying right now.

[Chris@Rvengeperformance]

see if they can create a firewall setting for you that locks the ftp server username to your ip address.

[DrGonzo]

Jim, who do you use for hosting?

They should be able to tell you what IP accessed your servers via FTP. From there they should be able to add those malicious IP addresses to iptables or something to block them out. They can also add your specific IP address so that only it has access via FTP, control panel, etc.

[Jimvr4]

I'm on a shared legacy server so I think they don't have those options available. I'll just run it until it is unmanageable then look for a new service or just take my stuff off the internet.

[DrGonzo]

Well, if you looking to change, When I shut down my VM server I moved over to iPage shared hosting for my personal stuff. It costs me like $20 a year. No issues with them in the last 4-5 months now.