Resolve an FTP / website blockage

This guide explains why an FTP account (and most of the time Web Hosting as well) can suddenly become blocked.

Preamble

• Infomaniak uses an antivirus solution on all shared servers to combat the sending of viruses via FTP and scripts.
• The antivirus allows to detect:
  • possible FTP account hacks
  • the voluntary or involuntary sending of files (WordPress themes, fraudulent modules, etc.) containing malicious lines of code or inclusions

Malicious file detection

The antivirus scans all files sent under 1 MB to prevent any upload of viruses/spam scripts/etc.

In case of detection of a suspicious element, the password of the FTP account is automatically changed and the incriminated files on the server are locked (FTPban).

The FTP server then sends a message to the FTP client of the type

550 Virus Detected and Removed: botnet.infomaniak.5.UNOFFICIAL

or

550 Virus Detected and Removed: winnow.botnet.ff.trojans.15900.UNOFFICIAL

What to do if the account is blocked?

If your FTP account is suddenly blocked, you will receive an email; follow the procedure indicated therein to unlock the situation. In particular:

• Clean your site and analyze what you intended to upload to the server.
• Check if the web applications and CMS you are using are up-to-date:
  • The cause of most hacks comes from a security deficiency in outdated web applications or weak passwords.

Solve the problem definitively

To prevent your site from being hacked and blocked again, perform the following actions:

• Update the web applications (WordPress, Joomla, etc.) and the extensions used.
• Delete unused web applications.
• Change the password for all your FTP accounts.
• Change the passwords to access the web applications (WordPress, Joomla, etc.).
• Change the password for MySQL database users.
• Delete the users of the MySQL databases that you do not use.
• Use a different, complex password each time, with a minimum of 8 characters.
• Run a manual antivirus scan on your hosting.
• Install and use an up-to-date antivirus (regardless of the operating system).
• Refer to this other guide if you are looking for information on monitoring and resolving vulnerabilities in hosted scripts.