Hi, I have more than 3 years with lunarpages... nice Service...

Today some people from HSBC BANK in LONDON call to my phone ( Phone register in my website)
And tell to my secretary If I dont delete some files from one folder in my hosting, Will be close my site.

3 hours later, I check files from my FTP account, Remove files and post a support lunnarpages and report this,
I receive an email from google  too... I send the copy to support too.

At this moment my account is suspend... I hope that Support offer me the solution, and the most important
no lost any... And I need to know what can I do, because I dont know too much about security...

I am afraid, because this kind of files that some one load into my webhosting  are criminals...

Help me please !!!

Regards.

Here the email from GOOGLE team:

Dear site owner or webmaster of gayguatemala.com,

We recently discovered that some pages on your site look like a possible phishing attack, in which users are encouraged to give up sensitive information such as login credentials or banking information. We have begun showing a warning page to users who visit this site in certain browsers that receive anti-phishing data from Google, as well as users redirected to this site from various Google properties.

Below are one or more example URLs on your site which may be part of a phishing attack:

http://www.gayguatemala .com/exper/IBlogin.html

Here is a link to a sample warning page:
http://www.google.com/interstitial?url=http%3A//www.gayguatemala.com/exper/IBlogin.html

We strongly encourage you to investigate this immediately to protect users who are being directed to a suspected phishing attack being hosted on your web site. Although some sites intentionally host such attacks, in many cases the webmaster is unaware because:

1) the site was compromised
2) the site doesn't monitor for malicious user-contributed content

If your site was compromised, it's important to not only remove the content involved in the phishing attack, but to also identify and fix the vulnerability that enabled such content to be placed on your site. We suggest contacting your hosting provider if you are unsure of how to proceed.

Once you've secured your site, and removed the content involved in the suspected phishing attack, or if you believe we have made an error and this is not actually a phishing attack, you can request that the warning be removed by visiting
http://www.google.com/safebrowsing/report_error/?tpl=emailer
and reporting an "incorrect forgery alert." We will review this request and take the appropriate actions.

Sincerely,
Google Search Quality Team

Thanks Mitch, I report inmediatly this situation, Support tell me some instructions and audit my site for security, and now my account is suspend and my tickets is in  Admin - Exploited Accounts I am waiting answer from them. Can you tell me, what is Exploited Accounts???  Till now I am waiting about 17 hours for answer...

Thanks.

Is the ban on "adult" material retroactive, or are existing adult sites grandfathered in? I can understand LP banning new adult sites, due to resource load and frequent attacks/hacks, but I would think that kicking off existing sites would result in a lot of irate customers and loss of business to LP. Of course, if other customers are suffering as a result of bans directed against shared servers, that may be something they'll have to accept (maybe they should offer a VPS at shared prices for the remainder of the customer term, or cluster all the adult sites on one shared server?). I know they used to ban just certain aspects of adult sites (such as using certain thumbnail generators or something), but I seem to recall that all adult material is now banned on shared servers.

After reading your post, I believe that your site was probably compromised using the following method:

1. You probably us an FTP upload tool that stores your username and password.
2. You may have a virus on your machine that stole your username and password.

Please do the following:
1. Run a virus scan on your machine and clean all viruses
2. Change your password.
3. Remove your passwords from your FTP tool

What are your thoughts on this matter?

Thanks,

Andre F. Barnes