Hi again everyone.

Tanks people for good input and feedback. The host still calims that this is DNN, and as someone said that I would not find anything in the IIS log. That was true. We did find out that there was a virus in the directory structure, I can't remember what it was but it said something about "backdoor". This was defenitely a scripting job, and I also think that (God forbid..) Front Page Extension is installed on the server. I have an option to install it for our web site by changing an option through my customer service account.

The host is a web hosting company in Norway, and I think I'll keep it as a secret for now. There were other DNN sites on the host that also were attacked, so we were not the only one. I am suspecting that some smuck installed something for another account, and then something happened. I have been running DNN for another website on that host for almost 2 years without anything happening.

Again; thank you everyone for valuable feedback.

Ronny

mn96.dns.gendistr.info: my users get a redirect to the above which downloads a virus. Does anyone know how this is possible? Each time my site gets corrupted i install a clean versdion which works for a while then the problem re-appears. Can anyone please help? The hosting company blames a hole in DNN.

Most likely, as with the original poster, your hosting company has something open and people are getting in and putting in a new default file into the root of your website which is redirecting your users before default.aspx gets hit