Strange link on home page

[Rich Atkins]

I have run a report (in WebCEO) to check for broken links, etc, and am surprised to discover a link on the home page of my site orate.co.uk to the following (which happens to be broken):

http://yalovasehri.com/css/ilan.php

Does anybody know what this is, and how I get rid of it?

Thanks

[Darren B]

looks like some has compromised you site, run a website refesh and see if its still there

[Rich Atkins]

That's cleared it - thanks. I'd feared that it was hidden somewhere in the code and would upload again.

[pinbrook]

do a thorough virus scan on your pc, and malware - the incursion could well have be uploaded from your machine.

[LHorton]

I get the following when I visit your site using Google Chrome (see attached image)

[Darren B]

theres some horrible things around at the mo, i am currently battling a rather persistant bugger at the moment. It manages to edit lots of files on the server some include statements like <codebase64 or similar but it has actually infected the actiniccore.js & actinicextras.js files on the server aswell.

ftp have been changed, also using the generate new password on the server and copying and pasting so its not typed anywere, the server has been wiped and reuploaded but it still comes back????

[Mike Hughes]

You should be able to see in your ftp logs whether they're ftp'ing into the site or have some other form of access.

If it is via ftp you might want to try blocking their IP address until things settle down. The last time I had something like this the Ip address was listed as being from the China Railway Company.

Mike