possible Java trojan?

Somehow got on my homepage....

[akmac]

I just got a few calls from customers saying that when they visited my home page, it tried to load a trojan onto their computers.

I looked at my index.html and sure enough-there was a little javascript on the bottom of the page that I didn't put there.

What vulnerability exists that would allow this? Is it server side?

I called my host-ipowerweb-and they said "Admins are aware if it"

Very helpful.

Anyone know how-or if-I can guard against this in the future? It seems to have occurred while I was uploading pages via ftp, but none of the loaded pages were affected.....

?

[lZakl]

I would suggest switching to a secure host. If they say they are "Aware" of it, this says to me; "Yeah, we know, but we don't really know what to do about it."

I'd pack up and high-tail to a host with a reputation for being secure...

[BjarneDM]

It's definitely not your fault.

The problem is that your web-hosting firm has been hacked (rooted) and has gotten a script that modifies each and every page - at least every 'index.html' page - that their customers upload to their accounts.

As Izakl states: If they are just 'aware' of it, it's definitely time to switch provider - the sooner the better. Any webhosting firm that gets hacked isn't worth the money you spend on them.