Jan: There is an infected file somewhere. What the scammer/hacker does is take a common file (like the USGW logo, for example) and put their virus in there. Then every time someone accesses the web site, their browser triggers a re-infection. You do not have to have the hacker come back and re-infect the account. The infected trigger file must be found and removed. This is akin to you brushing your teeth every night while having a cold. Then getting re-infected if you do not replace your toothbrush. You do not have to catch the cold from someone else, you are your own worse enemy. --- On Sun, 10/25/09, Jan Cortez <[email protected]> wrote: > From: Jan Cortez <[email protected]> > Subject: Re: [STATE-COORD] REINFECTION > To: [email protected] > Date: Sunday, October 25, 2009, 5:07 PM > PW access to the sites was removed on > the 15th of this month and no further > pw's have ever been forthcoming.  This was the day I > reported the start of > this last bit again.  That was 11 days ago. > > Here is a snip from your email that evening: > > ----- Original Message ----- > From: "Sherri" <[email protected]> > Sent: Thursday, October 15, 2009 7:30 PM > Subject: [USGENWEB-DISCUSS] Hacker Attack (Again) > > > > ********************* Please forward to all Project > Lists > > ********************************** > >> All sites that are hosted on theusgenweb.org > server will have the > >> passwords > > changed before you can log in again.  I'll be > starting on this immediately > > so that the downtime will be minimized as much as > possible. > > > > > ----- Original Message ----- > From: "Sherri" <[email protected]> > > > > Jan, > > > > Password access to sites on the same account with > theusgenweb.org and > > usgenweb.org was removed late on 21 October.  I'm > not sure when Maggie > > moved > > her site, but she most likely moved infected files - > or maybe her backup > > was > > infected.  As I've been going through folders, > I'd not paid any attention > > to > > any of the files from Maggie's Census Project because > she'd told me she'd > > moved her site.  I did take a quick look at some > of her files that > > remained > > on theusgenweb.org server and they contained some of > the code that I've > > found in files from other sites.  Since I have no > idea what she was > > finding, > > I don't know if it was the same or not as what we've > found. > > > ------------------------------- > To unsubscribe from the list, please send an email to [email protected] > with the word 'unsubscribe' without the quotes in the > subject and the body of the message >