JavaScript malware keeps getting added to my website

[buddydude]

For a couple months now, this has been happening:

1. Chrome reports my website has malware
2. I check and there's some strange JavaScript added to the bottom of every page
3. I download and quarantine the entire site, scan it, find nothing.
4. I scan the original local source files.
5. I reupload the entire site.
6. Site checks out ok.
7. A couple weeks/months later, step 1 happens again.

I am by no means a skilled sys admin. I started a small website to post an online portfolio and host phpBB forums for me and my friends. The only JavaScript I use is the inclusion of the jquery library and the thickbox plugin (for image galleries).

Any help you guys could give me to avoid this problem would be greatly appreciated.

If you want to see my site for yourself, it's

[tashi]

Hello buddydude,

Please don't post live links to a possibly infected site. ;)

This particular forum is here to help users with their infected PCs.
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Have you contacted your hosting company to report the problem?

Best regards.

[buddydude]

Sorry. I actually didn't want people going to my site but I figured the first response would be "what's the url?".

Yeah I contacted my web hosting company and they basically told me "that's your problem". There's no virus scanner in the control panel and they wouldn't do much to help me. Needless to say, I'm going to be shopping for new hosting as soon as my 2 year contract is up.

[tashi]

Hi buddydude,

I went to your site in a virtual machine and my anti virus program alerted to a Trojan infection. It did not present during a second visit.

However, you are already aware there is a problem. Please take your site off-line until you are sure it is clean.

Also suggest you edit out the link here: http://www.wp-wordpress.com/javascript-malware-keeps-getting-added-to-my-website

What is your hosting company. :)

[buddydude]

I appreciate the lessons in protocol so far, but does anyone have advise on how to track down the root of the problem and squash it?

[tashi]

I appreciate the lessons in protocol so far, but does anyone have advise on how to track down the root of the problem and squash it?




This particular forum is here to help users with their infected PCs.
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)




What is your hosting company. :)

Best regards.

[buddydude]

Cool, just as helpful as my hosting company.

Best regards.

[tashi]

Hello buddydude,


For a couple months now, this has been happening:


Cool, just as helpful as my hosting company.

Sarcasm doesn't become someone who has known their website may have been infecting users for two months and left it up.

I asked who your hosting company was twice, in case we could get someone on it.

If you wish to have further dialog you may send me a private message.

Regards. :)