My site reported for spam

[Mutikasa]

My VPS cent me a ticket that my site is having virus and sending spam. I have port 25 turned off. I believe it's a fake report or something.
MY vps provider got email form these guys clean-mx.de and now they want to wipe my VPS because I have a "virus".
I don't buy this. What can i do? Do you know any VPS that ignores this?

 

[HostStage]

I'm not sure about clean-mx and how legitimate they are.
However, regarding the mail spam, if you are using wordpress it is very common issue.

Today, on my daily morning routine, I had to clean 2 websites infected by such malware. By cleaning, i don't mean that I whiped the hosting account out but cleaning the malware without the user even knowing it.

Wiping out the VPS seems a bit an extreme solution. There are quite a few steps before doing such things to secure the website / server.

 

[Mutikasa]

No, you see, my site is pure html and javascript. It's a landing page. Upon investigation I have seen that these guys, CIRT Germany are reporting all the similar landing pages.

 

[Wilson Grant Fisk]

Lots of complaints about that company clean-mx.de
http://www.clean-mx.de/


Looks like they have flagged a lot of sites for false positives:
http://virtuallyfun.superglobalmega...ass-of-the-year-award-goes-to-gerhard-recher/
http://www.boredomsoft.org/clean-mx.bs
http://www.thesafemac.com/the-problem-with-website-threat-scanning/

 

[Mutikasa]

PM'ed did you get my message? Thanks!

No I didn't. I dont think you can send PMs yet

 

[bermanHost]

Find the injected script and disable it by changing the permission and ownership of the file. Install antivirus software and have a scan daily. Install maldet scan in your server which is a best one to scan for virus hits. Some times spamming can be due to account compromised, so change the password very often if it is a wordpress site.

 

[Mutikasa]

i have scanned with many software. nothing found. port 25 is disabled

 

[ChanzGrande]

No legitimate VPS provider should be threatening you because of this type of contact from an external third party. Whereas there is very little of legitimacy to the complainant one would think your VPS provider would recognize the false positive.

You would think showing them documentation regarding your scans coming back clean would be sufficient. Seems like this third part is acting as police without the proper credentials and your VPS provider is responding favorably to their inquiries. I'd be moving my VPS straight away as the only way this makes much sense is if they are in on the scam.

 

[Mutikasa]

No legitimate VPS provider should be threatening you because of this type of contact from an external third party. Whereas there is very little of legitimacy to the complainant one would think your VPS provider would recognize the false positive.

You would think showing them documentation regarding your scans coming back clean would be sufficient. Seems like this third part is acting as police without the proper credentials and your VPS provider is responding favorably to their inquiries. I'd be moving my VPS straight away as the only way this makes much sense is if they are in on the scam.

this is a good point.

 

[Rankin42]

important issue and some great point notched

 

[Nut-Nights]

Just backup your site and change your host. If i am at your place i will never keep my site with such a host.

 

[Boriss]

Your host needs to learn about sites like clean-mx.de

They are emailing hosts with various reports showing malware, so your host will hire them.

They are scammers.

 

[Mutikasa]

Your host needs to learn about sites like clean-mx.de

They are emailing hosts with various reports showing malware, so your host will hire them.

They are scammers.

Do you have anything about that? So others are doing the same , I guess. So called spam protectors.

 

[bermanHost]

What kind of scan did you do? Out of 100, 90 percent the issue should be because of spamming script injected along with the html or java script in your website code. If you wish we can make a look over your server.

 

[bermanHost]

Whatever the case is first take a backup of all the important files fro your VPS before the provider flush it off.