All my 10 sites were hacked! hosted on justhost

Ouch,

You have to contact justhost immediately and inform them of the situation.

I've been hacked before and it was due to my CHMOD file permissions being left open to the public.

And you have to make sure that all your plugins are updated to the last version

ohh thats really BAD news mate.

Sorry to hear, but I only trust my site's to Hostgator nothing else.

Why do people do this!!!
You need to contact your hosting straight away and they should be able to restore your sites and help you.

Do the sites get any traffic? You need to find out what made them target your site and work around it and stop it happening again. I think people who hack sites are very sad and how the hell do they do it! There sad people!

But yes contact your host now! If they have a live support option just use that Hope you get the sites back to normal, keep me posted on what happens!

ArranRice!

Your story tells us it is very important to choose a good host. I have not met this situation before and all of my sites are hosted on reliable hosts, although it costs me an extra of money.

Talk to your hosting company immediately and see what they can do. Some hosting companies have more security and gives users a better chance of getting back their site.

Wish you luck!

I can't give much advice on this one my friend....just wanted to say sorry to hear it. Some people just suck.

Jim

You just scared me. I had a site on justhost and I am glad it is not hacked.

contact justhost immediately and request an explanation of what is going on

It still could be that all of my blogs on JustHost became suddenly infected somehow but nothing shows up when I download and scan all the files. This all started around the time of the last WordPress update, to 3.3, but certainly could be a coincidence. I used the "automatic" update within the admin area to do the upgrade.

Ugly stuff.

JustHost support just 'scans' my account and says "Nothing is wrong. Please clean your computer."

so sorry to hear of this

Thanks for some great information. I’m glad it wasn’t worse. You are a saavy guy with computers and know what you’re doing. I don’t have a website, just a blog which soon will also be my business.

thanks very much!

Definitely speak to your host and see if they can restore your sites back to their original state. Then investigate how you can back-up your sites in future.

There are some really good threads here on site security and what to do to protect your sites.

Looking for ways to change your table settings, upload a .htaccess file to the wp-admin folder, use stronger passwords, don't use 'Admin' as the login in name, change your existing passwords (including your FTP account one) and start backing up all your sites on a regular basis.

These threads may help:
http://www.warriorforum.com/main-int...e-hackers.html

http://www.warriorforum.com/main-int...ress-site.html

http://www.warriorforum.com/main-int...your-site.html

Justhost are the worst hosting company in my experience. My sites, regardless of CMS all got hacked multiple times, there is definitely some sort of vulnerability in their system. I've now been with a new host since October and no hackings since (exactly the same websites).

Yeh very common. I had 100 sites hacked on host dime before...boy it wasn't good. My SERPS fell like a rock! It was terrible.

In terms to fixing it the biggest vulnerability is when you don't update your site. The sad thing is wordpress has a lot of vulnerabilities and VERY easy to hack. You can get some plug ins to help but it isn't a perfect solution

You should also consider adding additional security to your sites against hackers with a readymade plugin like WPLockup which provides multi layered security features like custom admin login page, http authentication and captcha login screens.

Get someone who knows about security and have them scan through and check for all areas for possible security flaws.

I am pretty sure you can get some good help on WF.

Listen learned.. Never trust other hosting service provider accept for hostgator and bluehost..

May God bless you,
Jeremiah

Were all of your sites standalone HTML?

Or were they WordPress blogs?

sorry to hear about your website being hacked.
never used justhost before so not sure how reliable they
are.

I Have my websites with hostgator.

I hope you backed up your websites. If so then you may
want to move it to a more reliable webhosting service.

The problems might be in the wordpress files or theme files or plugin files, or somewhere outside of the wordpress files altogether. OR the problems could be in the database.

Chasing these things down (and I've done it multiple times, and it's not always the host's fault) is time consuming and you have to find all the dang spots they've injected code. If you leave even one, you're scrooed. I would also run virus and malware and trojan scans on your own machine. It is very possible that's their vector. Make sure to do an online trojan and rootkit scan since some savvy malware will turn off your AV program but make it look like it's still doing its job.

I have seen alot of replies from Warriors saying they downloaded the files and scanned them, I am not an expert but when they hack your site, they modify the files and add redirects so even if you scan, you won't see anything, they do not put a virus or malware on your site ( usually ) they either change the homepage to prove a point or they redirect the traffic to another site, its all about changing few lines without adding any software to your site.

Well, now after looking carefully at my WordPress installations, I can see the problem. Apparently my sites were hacked too: ALL javascript file, every single .js file had been changed on 12/27/2011, 2:40am. Each file had the same bit of code appended, which, I'm sure if I untangled it, would be the browser redirectiom I had been seeing.

I've been using some of the most popular protection plugins, but I might as well save my time and web space and not even bother.

Not sure we, as WordPress users, or regular old web builders, can stop someone who seems to have free access to our accounts to just edit anything they want ...Aaargh.

Well, how very interesting - WordPress has just issued yet another release, Version 3.3.1 - says someone had discovered a cross-scripting security hole in the Version released in mid-December. Guess that might explain some of the problems folks have seen, here on JustHost as well as some other servers I suppose.

I will test my problem again after I get my installations cleaned up from scratch with the new 3.3.1 Release.

Oh no... I feel for you as I had a similar experience before... I believe they hacked my sites through my SQL database... I ended up paying someone to fix it then got a guy from Fiverr to reinforce the security for my sites (WP). Since then non of them have been hacked.

Let me guess....Wordpress?

Contact your hosting company ASAP they have the know-how and expertise to deal with recoving it for you.

Your sites being hacked have NOTHING to do with the host. It has EVERYTHING to do with you ensuring your sites are secure.

if you are using Wordpress, try to avoid using "Admin" as your username. one of my big site was hacked because i was using "admin" as username and always update it.

Yes, I have verified this now.

I don't know if the cross-scripting vulnerability introduced with the recent (Mid December) WordPress 3.3 caused this, but on December 26 and 27, every site I have on JustHost has had EVERY SINGLE *.js file modified by adding code at the end. This is semi-encoded and appears to be browser redirect code.

I'll get it decoded to see if the USSR site that's been serving me the "Security Center 2012" threatware is indeed the end redirected target.

If you are on JustHost, you might want to look at the very end of your *.js files for something that starts out like this:

var _0xdc8d=["\x73\x63\x5F\x63\x6F","\x67\x65\x74\x45\x6C\x65\x 6D\x65\x6E...

And ends something like this:

...var head=document[_0xdc8d[21]](_0xdc8d[20])[0];head[_0xdc8d[22]](js);} ;



EDIT:
After translating the escaped Hex codes, I have verified that this .js hack indeed carried the code to redirect to the Russian malware site I was seeing blocked by MalwareBytes. If I didn't have the blocking enabled, I couldn't see anything unusual going on until later, when all of a sudden I'm infected with the "Security Center 2012" threatware.

It's now just a matter of removing this from all my sites .js files. The first cleaned site now appears to be operating normally. I'll notify JustHost Support, for whatever good that'll do.

Yes,I use Wordpress,it is my favourate script. now I have restored all my sites.they only change my homepage without modify other files,so it is easy to be restored..

if you are using ant wordpress security plugins ? i prefer to use some security plugins and back your blog regularly

I'm not exactly sure what you should do, as I am no hacking specialist. But I would like to thank you for informing the Warrior Forum community about this. I will not be using JustHost in the future due to this incident and other incidents I've heard in this thread with them as hosting providers.

That's so unfortunate for you. The important thing to do right now is to contact justhost. They need to explain to you and fix your problem.

I upgraded to the latest wp version too... I feel we should all be safe for now...

Well, shoot! Looks like last night all my sites on JustHost were attacked again! This time, they installed a nifty little drive-by trojan. Anyone just browsing to my sites gets redirected to a Russian Federation ugly site, very quietly in the background.

Latest W.P. (3.3.1) and all plugins updated.

I asked JustHost if they could restore from their backup and they agreed. Unfortunately, the backups all included the trojans, too.

Looks like it's time to pick up the whole thing and move to a new hosting company!

When I was hacked all my affiliate sites (on two different hosts) were attacked - the only link between those two hosting accounts was my FTP software.