One of my hosting accounts had this phishing scam placed on it and I was notified by the bank today. Immediately I deleted the files in question - but it came back, so something somewhere is re-writing it. How can I find out what that is and remove it properly. I've searched all over and can't find any clear removal guidelines for the Bradesco Bank phishing scam, the search term is buried by reference to the related emails and the local effects rather than how to remove this via ftp. Does anyone have any experience of this one - or perhaps a good source of information to tell me how to sort it. Thanks
I'm sure it is. Has happened before and I usually find some removal instructions. But I'm struggling with this one to find any information.
We posted some info on phishing here: http://blog.sucuri.net/2010/04/suntrust-phishing-case-study.html They generally leave a PHP script to be able to upload files at their discretion. So you have to do a scan on your site looking for that.. If you need help, send me a PM.
Very impressed by the quality of info on your blog. I seem to have it fixed now. But please PM me your rates for this type of clean up in future. Thanks.