Trojan horse on my sites

[LD]

Originally Posted by cd34

The hacker used the FTP username/password to modify a few files on the server. Generally when that happens, the username/password has been leaked somewhere through a keylogger/spyware/trojan or, like this case, a vendor storing the user/password/hostname in the clear somewhere.

When you give a password to a vendor, you should change it after they are done, or, change it to something, give it to them, and then change it after they are done.

You would be surprised at the frequency this happens.

Thanks for getting fixed so quickly.

Guess you can't be too careful...live and learn.

[SimonT]

Had this happen to me too but not with JBM - created a temp ftp account and sure enough after the company had used it someone else sneaked in and installed a load of crap on the server.