Trojan horse on my sites
 

Avast is reporting problems on some of my sites:

I am working on getting it fixed, sorry for the inconvenience.

I have AVG integrated with my Google search, and they're still saying your sites are safe, so that's good. As long as you get it fixed before Google begins de-listing you, you'll be fine. I clicked-through to all of them, and only the free for all site is popping something suspicious. Something about an unverified application attempting to run.

This is it,
http://www.greenguysboard.com/board/...1&d=1275572048

Chris at Colo-Cation is on it, looks like it's fixed. I just notified him this morning a little while ago, so it was a very quick response and fix.

It looks like someone uploaded something via ftp using my login. The interesting thing is, I recently entered my login info in the "hidden" area at JBM software's support forum for Jeremy to check something out. That's the only time I have ever given this info out...hmmm

That would explain the other client with tubex being compromised from the same IP.

Is this a tubex related incident or JBM Soft?

All of a sudden I'm a little worried now.

The hacker used the FTP username/password to modify a few files on the server. Generally when that happens, the username/password has been leaked somewhere through a keylogger/spyware/trojan or, like this case, a vendor storing the user/password/hostname in the clear somewhere.

When you give a password to a vendor, you should change it after they are done, or, change it to something, give it to them, and then change it after they are done.

You would be surprised at the frequency this happens.

This is why I always add a user name with a temp password to my server that I then change after they are done.

I did this just last month after I wanted JBM Soft to take a look at my install of TubeX.

Thanks for getting fixed so quickly.

Guess you can't be too careful...live and learn.

Had this happen to me too but not with JBM - created a temp ftp account and sure enough after the company had used it someone else sneaked in and installed a load of crap on the server.