This guide explains why an FTP account (and most of the time Web Hosting as well) may suddenly become blocked.

Introduction

• Infomaniak uses an antivirus solution on all shared servers to combat the sending of viruses via FTP and scripts.
• The antivirus detects:
  • potential FTP account hacks
  • the intentional or unintentional sending of files (WordPress themes, fraudulent modules, etc.) containing malicious code lines or inclusions

Malicious File Detection

The antivirus scans all uploaded files smaller than 1 MB to prevent the upload of viruses, spam scripts, etc.

If a suspicious element is detected, the FTP account password is automatically changed, and the files in question on the server are locked (FTPban).

The FTP server then sends a message to the FTP client of the following type:

550 Virus Detected and Removed: botnet.infomaniak.5.UNOFFICIAL

or

550 Virus Detected and Removed: winnow.botnet.ff.trojans.15900.UNOFFICIAL

What to do if the account is blocked?

If your FTP account is suddenly blocked, you will receive an email; follow the procedure indicated in the email to resolve the issue. In particular:

• Clean up your site and analyze what you want to send to the server.
• Check if the web applications and CMS you use are up to date:
  • Most hacks are caused by security vulnerabilities in outdated web applications or weak passwords.

Resolve the problem permanently

To prevent your site from being hacked and blocked again, take the following steps:

• Update the web applications (WordPress, Joomla, etc.) and the extensions you are using.
• Remove any web applications that you are not using.
• Change the password for all your FTP accounts.
• Change the passwords to access web applications (WordPress, Joomla, etc.).
• Change the password for MySQL database users.
• Delete MySQL database users that you are not using.
• Use a different, complex password each time, with a minimum of 8 characters.
• Manually launch an antivirus scan on your hosting.
• Install and use an up-to-date antivirus program (regardless of the operating system).
• Refer to this other guide if you are looking for information on monitoring and resolving vulnerabilities in hosted scripts.