Someone has inserted malicious code into some of the blog posts on Streamliner Memories as well as my other blog, the Antiplanner, plus a third blog that I haven’t posted to in several years. The code is mostly invisible to users, but I can find it in the WordPress editor. The code consists of some ramblings about cialis inserted into the middle of the post plus some random numbers — hexadecimal? — at the end of the post. So far, the code doesn’t seem to be dangerous to users, but that could change.

In the past, when this site was hacked, my web server would do a scan for malware and send me the results, allowing me to erase or replace malicious files. Now, my server says they won’t do anything unless I pay them $300 a year per web site. Various security companies on the web say they will scan the site for malicious files; when I do that, they all report there are no malicious files but if I pay them $300 to $500 a year they will guarantee to clean out the malicious file they couldn’t find.

I am uncertain what to do about this. I hate to lose the ability to distribute historic railroad documents to interested readers. The Antiplanner is also a record of nearly two decades of research on various land-use and transportation issues.

So it seems I have to choose between paying someone hundreds of dollars to clean up the sites; shutting down the sites; moving the sites to a new web server that might not charge me as much to keep the site infection-free; or figuring out how to fix the sites myself. If any readers have any ideas or experience with this, please leave a note in the comments or send me an email.