Website 'hacked'
Could be either. 
If it's on ccgi, you can only ftp from a plusnet ip, which would make the latter less likely, unless your pc has actually been botted. If your av was capable enough to warn you about your own site, that also makes the latter less likely.
It would help to know what's loaded onto the site, and if your av identified the injection (please don't post the injected code), and what browser, av, and os you use.
Gabe
If it's on ccgi, you can only ftp from a plusnet ip, which would make the latter less likely, unless your pc has actually been botted. If your av was capable enough to warn you about your own site, that also makes the latter less likely.
It would help to know what's loaded onto the site, and if your av identified the injection (please don't post the injected code), and what browser, av, and os you use.
Gabe
Russians again.
(BTW, I like the way IE 8 thinks it's cool.)
If your site has no db interface, they can't have got in that way. As JohnJ says, it looks like the ftp password. Changing that would be a first step. If it's on ccgi, then PN will need to change it for you. (Incidentally, if changing a password yourself doesn't seem to stop the hacking, it suggests that your own PC or network is infected.) Passwords can be ripped, intercepted (ftp is plaintext), or (commonly) sniffed from your own pc by malware lurking or just hopping into the browser session. If the site is on ccgi, it limits the options. If you keep logs, it might be worth checking through those. Your pc doesn't sound unusually vulnerable, but it might be worth hitting it with an alternative av, just to check.
It's a pandemic.
Gabe
(BTW, I like the way IE 8 thinks it's cool.)
If your site has no db interface, they can't have got in that way. As JohnJ says, it looks like the ftp password. Changing that would be a first step. If it's on ccgi, then PN will need to change it for you. (Incidentally, if changing a password yourself doesn't seem to stop the hacking, it suggests that your own PC or network is infected.) Passwords can be ripped, intercepted (ftp is plaintext), or (commonly) sniffed from your own pc by malware lurking or just hopping into the browser session. If the site is on ccgi, it limits the options. If you keep logs, it might be worth checking through those. Your pc doesn't sound unusually vulnerable, but it might be worth hitting it with an alternative av, just to check.
It's a pandemic.
Gabe
Hi John, that sounds VERY similar.
I'm not sure whether CS read these pages but can anyone confirm whether changing the FTP password will mean changing the PlusNet account password (used in the router and the Member Centre)?
I don't mind having to change it - but I'd rather know before hand than suddenly loose my connection
@Gabe
Databases and PHP are activated for the site and there is a sub-folder with a simple page that just sets up a connection. However, as it's only the index.htm pages that seem to be affected I think John's suggestion is probably nearest. CCGI is activated so I guess I'll have to raise a call to get the password changed
Barrie
I'm not sure whether CS read these pages but can anyone confirm whether changing the FTP password will mean changing the PlusNet account password (used in the router and the Member Centre)?
I don't mind having to change it - but I'd rather know before hand than suddenly loose my connection
@Gabe
Databases and PHP are activated for the site and there is a sub-folder with a simple page that just sets up a connection. However, as it's only the index.htm pages that seem to be affected I think John's suggestion is probably nearest. CCGI is activated so I guess I'll have to raise a call to get the password changed
Barrie
changing the FTP password would mean changing the main account password.
Gabe,
There are files on both ftp.plus.net and cshell.plus.net but only the index files on ftp.plus.net seem to be affected. There is an index file on ccgi.{username}.plus.com but that seems to be clean
@ Adam - thanks for the warning
There are files on both ftp.plus.net and cshell.plus.net but only the index files on ftp.plus.net seem to be affected. There is an index file on ccgi.{username}.plus.com but that seems to be clean
@ Adam - thanks for the warning
