It appears my shared hosting is compromised. Again.
Contacted my support, but I know they'll do sack all unless I essentially delete every single php file off of the site. Which means unless I make my hosting pointless, they won't bother looking to see what's going on.
It is not FTP access - after I found (within 3 hours admittedly) someone had inserted an iframe into two pages - I removed it. I then changed all file perms to 444. This means my ftp accounts cannot overwite the files. They cannot be edited in situ from my own control panel either (without changing the file permissions). This takes time
However, today, I check (i've had a hard week, so barely checked the site this week at all as I've disabled comments to make life easier). Turns out 2 days ago the same thing happened, but every single php or html file with the </body> closing tag has had inserted infront of it an iframe. Worse still, they were done one after the other within a second each time. That's no FTP (especially given permissions). Nor is it someone in my control panel (takes too long). It's a fucking script. My site is clean of such scripts...
Anyway, this invisible iframe will aid deliver a nasty to your computer (most likely only really dangerous if you're computer is no up to date).
Obviously it then tries to exploit your computer :/ I only know as my antivirus blocked me from my own site - a sure sign something isn't right, before telling me it's a script located on some indian domain.
I've just ranted via support form to the hosts help as I know it'll go no-where. I've also re-written many php files to remove any mention of </body> and </html> tags, replacing them with obfuscated php echo statements (so a simple regex of a php/html file won't find the tag. Any files not containing these tags were left alone) so that hopefully it won't happen again as the script that is doing this won't find the tags it is looking for.
So anyone visiting PLEASE run your anti virus to check. If you don't have one, then some GREAT free ones are avast, avira and avg (i recommend avast at present). Please accept my apologies - days like this really make me question whether to bother. Had a great but awkward / stressful week at the new job and then come back to this shit. Fuckers.
I await feedback from my host regarding this, but I am positive sack all is going to occur other than "change all passwords, it is your computer that has been compromised". They need to search to find the issue, but i'm sure they won't :/
*goes off to find some wine to drink*.
The real shame is no-one contacted me. Then again, kinda hard if every page is giving you virus warnings I guess