[jaysonnhs]

Our website newhomessection dot com has a virus and it keeps coming back. The virus is at the bottom of our index.php pages. We keep deleting it off of several pages but it keeps coming back. We even uploaded a clean site and ??? still comes back.

We use WP (2.5) as a /blog subdomain
bluehost is our ISP but they don't care
Our developer is stumped


Any help would be greatly appreciated -

[Advertisements]

Welcome to GTG.

You need to find out how it's infecting your webpage. Could it be that your own files that you uploaded were infected as well? I'm not sure how much we can help out from here...usually the host takes care of that, but since you said they don't even care, it might be time to go with a "real" webhost and not one provided by your ISP. Even a free one will do, just so you can test it out. I think 110mb.com is a free one you can use to try out.

I looked at your site with Firefox and don't seem to have anything alarming here. I do see this piece of code though:

<meta name="verify-v1" content="lQoQFMRwmSLwCkcc4+zckt0EBbuL5ma41dAtuMMTeko=" />
<link href="http://www.newhomessection.com/nav/new-layout/hype-does-valid.css" rel="stylesheet" type="text/css" />
<meta name="verify-v1" content="QY3LWMe9aIH+/gqf/trWJfFojcQJPd6We0PaoYkOlLs=" />

Do you know what that's for? The middle line is for your stylesheet, but the other two look very suspicious. See if you have that on your own computer files. If so, you need to remove them first and then upload them back.

[greyknight17]

Welcome to GTG.

You need to find out how it's infecting your webpage. Could it be that your own files that you uploaded were infected as well? I'm not sure how much we can help out from here...usually the host takes care of that, but since you said they don't even care, it might be time to go with a "real" webhost and not one provided by your ISP. Even a free one will do, just so you can test it out. I think 110mb.com is a free one you can use to try out.

I looked at your site with Firefox and don't seem to have anything alarming here. I do see this piece of code though:

<meta name="verify-v1" content="lQoQFMRwmSLwCkcc4+zckt0EBbuL5ma41dAtuMMTeko=" />
<link href="http://www.newhomessection.com/nav/new-layout/hype-does-valid.css" rel="stylesheet" type="text/css" />
<meta name="verify-v1" content="QY3LWMe9aIH+/gqf/trWJfFojcQJPd6We0PaoYkOlLs=" />

Do you know what that's for? The middle line is for your stylesheet, but the other two look very suspicious. See if you have that on your own computer files. If so, you need to remove them first and then upload them back.

[greyknight17]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.