Malware Warning on my Plusnet Space

[#1]

I have to say I'm very sorry I missed that - lesson learned. It'd probably be worth changing the password on your account, that will also change the webspace password and should stop it from happening again.

[#2]

Doh!!! 
I'd tried that and seen nothing. Just asked Chris if the .htaccess contained a
RewriteCond %{HTTP_USER_AGENT} .*Windows.*
line. It did. That explains it.
The exploit looks very much like the recent hijacked-subdomains scareware thing. Is the OP's PC definitely trojan free?
Gabe

[#3]

Thanks for clearing that Chris. Any idea where it came from?
I can confirm that my computer is clean.
Thanks again,
Pete.

[#4]

Quote from: Matt

I have to say I'm very sorry I missed that - lesson learned. It'd probably be worth changing the password on your account, that will also change the webspace password and should stop it from happening again.

Will do. Thanks.
Pete.

[#5]

Quote from: Badders

Any idea where it came from?

Ultimately, probably Russia  >:(. The upload could have come from anywhere. The login details typically come from a compromised PC or local network. Have you logged into Plusnet away from home recently-ish?
Gabe

[#6]

Quote from: Matt

I have to say I'm very sorry I missed that - lesson learned. It'd probably be worth changing the password on your account, that will also change the webspace password and should stop it from happening again.

1 last question, Matt. I've done as you suggested and changed my account password. However, Email is still working on the old password. Should that not have changed automatically? If I try to log in using the new password, it fails.
Pete.

[#7]

If this is PN webspace then the htaccess file must have been uploaded from PN, as the FTP server doesn't allow non PN connections.
Or did that change recently?

[#8]

Hi Badders. It will only have changed the default mailbox password but not the password for your other mailboxes. I have tried logging in to the default email address via webmail and I can get in ok on that.
Jojo:)

[#9]

Thanks Jo,
I'll eventually wake up and the blindingly obvious will hit me right between the eyes 
Pete.

[#10]

Quote from: avatastic

If this is PN webspace then the htaccess file must have been uploaded from PN, as the FTP server doesn't allow non PN connections.

True for ccgi, but not for homepages (or PAYH). Wonder how they got the login.
Gabe

[#11]

The rogue .htaccess could have been dropped by a drive-by attack on a script on the site.
Would have been interesting to grab the 'last modified' date off it, but I suspect it's now long gone.
B.

[#12]

Just to be clear, a drive-by attack usually means involuntarily picking up a nasty from a script on a site, not an attack on a script on a site. The OP's PC could have been botted by a drive-by but need not have been - could just have been harvested for credentials. I agree, it could be revealing to search the server logs.
Gabe

[#13]

Quote from: Barry

The rogue .htaccess could have been dropped by a drive-by attack on a script on the site.

On homepages?