I bought my brother a domain name and some hosting space to play around with. Just found out this morning that it was apparently hacked by a turkish hacker who installed cyberspy asp pages on the machine.
I've erased everything and changed all passwords. What are the chances that the actual server itself is infected? I've notified my hosting company but no response so far.
It is possible that one of the IT guys at the hosting company hijacked the site... happened to me about 3 years ago.
Well, if your using ASP, then the O/S is IIS (I dont think there is a Unix/Linux ASP parser out there)
I had this happen to my home machine twice (I have 3 servers down in my basement, one for hosting (win2000 advanced server), one for file storage (xp pro), and one for testing (linux SUSE, cause red hat no longer exists)). Usually they get in through loose permission settings or easily brute forced passwords...
I would suggest that you take carefull inventory of the passwords you use, make them complex (more than 8 characters, and include numbers in there as well). Also, only give write permissions to the directories that absolutely require it (like a database directory (for access db) or a cgi-bin for files that you want up upload or change).
A simple lock down on your end is probably what is needed.. However, I would contact the hosting company and mention the hack... The host could have some very loose permissions setup as well. For your directory, they should only have one account that can access it (besides your accounts) for general overriding. That account should be specific to your account (meaning not a general administrator account, but an administrator account specific to your account that way if the general administrator is a moron (believe me, I have seen many IIS admins have their accounts hacked due to their password being completely easy) then someone cant just gain access to the whole server.
Just a few things I guess, take what you want and leave the rest.
Thanks for the comments guys.
I've changed passwords and locked down as best I can. My hosting companies response was that they have not issue and are totally secure. (yea, right...)
I'll be paying close attention to the site.