Help! Malware has taken over my groups website...

Hi,

A malware warning started showing up and now i'm being redirected to another website that keep crashing my browser.  I followed some of the directions I found on other sites and have downloaded Mozzilla along with NoScript and AdBlock add on and can now see the pages on the site.  The content is still there, thank goodness, but the are several lines of pharmaceutical links.  I've reached out to the web builder but I'm not sure if they can do anything.  I'm a volunteer and would appreciate any guidance in dealing with this.

Thank you!

Dawson

Hi Dawson,

Welcome to Tech Soup.

Do check your web site from an Internet Cafe or a friends computer, just to be sure it is your web site that is infected and not your computer.  If it is your web site your web developer should be able to get on your web site and change the password, and clean up the mess.  If it is your computer that is infected, Malware Bytes  is a tool that seems to be pretty effective http://www.malwarebytes.org/

If you have other questions feel free to post them in our forums.

Dave

Thank for replying so quickly.  The strange thing is I'm accessing the site from a borrowed Mac laptop.  I didn't think this stuff was supposed to happen to a Mac?  Another volunteer said they can't see anything but the headers and none of the content.  I've searched for malware software for Macs but haven't found anything.  I did notice some posts on Safari 4 having similar problems but Firefox witht he add ons is showing the pharmaceutical content above the page content so I 'm not sure what to do.  There have been several volunteers that have worked on the site.  I've reached out to the company that built the site, Elevacion, but haven't heard back from anyone in a couple days.  

What would  the correct course of action be to get the site cleaned up and secured?

 How can I solicit the help of others that have experience with this process?

Step one: Back up the entire site.

Step two: Delete the entire directory where the site existed.

Step Three: Restore your site from your most recent backup prior to the symptoms (not the one you just created in step one above!) If you KNOW that this issue first arose on November 10, tell the web host to restore your site from the backup made on the night of November 9.

Step Four: Change the current FTP and general website passwords.

If your web host says they do not have a backup, then you need a new web host.