I need some serious help ASAP!

7 replies
"First i want to apologize if this is the wrong place for my post."
I need some serious help ASAP!

I need someone's help right away. I have all my websites hosted on the same account and they have suspended my account because of spam they said. I have never had this problem before and do not know what to do. But until I get rid of it all my sites are not functioning.

I already tried soliciting the help of my hosting company but when they send me messages I do not understand what they are saying?

I have transferred my public_html file onto my PC and scanned it and it came back with nothing found.

This is the most recent message I have received from the hosting support:

"I've just checked your account for suspicious code. I've saved the result in the ~allinon6/public_html/shellfinder_result file.
Possibly to one of those files was flooded shell. Kindly check your scripts."

I reviewed what was in the file and thought that I eliminated the problems. Guess not.

Pierre
#asap #serious
  • Profile picture of the author ussher
    Hard to know what is the exact issue they are talking about without looking at the scripts.

    It could be that something in your code allows access to the server and someone has taken advantage of it.

    It could be anything.

    Something like this is a MAJOR security hole:
    print $_GET['text'];

    Because the incoming data is not filtered for any sort of malicious data. Its just taking whatever the user sends it and is treating it as safe.

    You need to treat any incoming user input as suspicious and dangerous.

    Its easy to tamper with data just to see what happens. heres a link to a few security hole examples:
    Top 7 PHP Security Blunders Article » SitePoint

    So what you need to do is exactly what they say "Kindly check your scripts" because they think that something in them is allowing someone to use your server to send out spam.
    Signature

    "Jamroom is a Profile Centric CMS system suitable as a development framework for building entire communities. Highly modular in concept. Suitable for enterprise level development teams or solo freelancers."

    - jamroom.net
    Download Jamroom free: Download
    {{ DiscussionBoard.errors[4194652].message }}
  • Profile picture of the author Russell Hall
    Not a nice thing to have happen.

    I'd do two things here:

    1) hire an accomplished cPanel systems admin guy (you might find one in warriors for hire but you'll definitely find one on Scriptlance, and get them to find where the problem is. This might cost you $20 but it's worth it.
    2) find a new hosting company that is more supportive and more willing to give specifics of where problems lie instead of generalizing and then sending you in a witch hunt.

    I wish you the best with it :-)
    Signature

    Mvlti svnt vocati, pavci vero electi - Many are called [but] few are chosen

    {{ DiscussionBoard.errors[4194693].message }}
  • Profile picture of the author nthmarketing
    PM me if you need to me to help walk you through things
    {{ DiscussionBoard.errors[4194827].message }}
  • Profile picture of the author Chucksta
    That happened to me last week, but my account was not suspended.

    The Hosting company, Just Host, reset my password, cleared the offending data, then contacted me.

    I then had to use the new password they supplied to set a new password for myself.

    No downtime for my sites
    {{ DiscussionBoard.errors[4197071].message }}
  • Profile picture of the author Gary Zaydman
    Its easy to resolve. Someone probably got into your site through a script you have it installed. Most hosting companies will resolve this for you if you ask them. I know hostgator will. That's what I use and that has happened to me before.
    Signature

    Best pressure-less sales method to get local small business clients to try your services www.reputationrebelsystem.com

    {{ DiscussionBoard.errors[4199734].message }}
  • Profile picture of the author prmoise76
    Hello,
    I have been trying since 8am this morning to reply to all of you but WF was giving me difficulty. It wouldn't let me reply individually so I am posting all my responses in one big message. Hope these replies make it through.

    Reply to ussher

    Yes I know. They did send me a file with the "suspicious" files but looking at it I have no idea really what it means. I tried going to the files listed and eliminating them. But I am assuming there must be more to it than that because the hosting company said I was still hacked.

    When you say look at the scripts what exactly does that mean? Where do I look and how do I know if it is not good?

    I dont read scripts so more than likely I wouldnt recognize a bad file.

    Thanks in advance and for the help so far,
    Pierre


    Reply to Russell Hall

    Yes it definitely isnt nice because all my sites are on hold right now. Once I get the issue resolved what is the best way to preevnt it from happening in the future? Is there some type of software etc?

    Thanks,
    Pierre


    Reply to nthmarketing

    Yes I might have to give you a PM because I am lost. Thanks!


    Reply To Chucksta

    Really? I have just host. They didnt remove anything for me. They suspended my account and told me that I would no have my account unblocked until I removed all the stuff myself. I think I better call them and find out why they are not doing the same thing for me. Thanks for letting me know!

    Pierre

    Reply to Gary Zaydman

    That seems like a logical choice to me since they know more than me and I am paying them every month! I do not have host gator but I will call my hosting again and ask them.

    Thanks!
    Pierre
    {{ DiscussionBoard.errors[4200897].message }}
    • Profile picture of the author ussher
      Originally Posted by prmoise76 View Post

      I dont read scripts so more than likely I wouldnt recognize a bad file.
      Yeah that makes it harder. about as hard as you handing me a book written in Russian and asking me to check the grammar. (I don't know the language, so just can't do it.)

      You need someone who can do it.

      If the scripts are a well known script like wordpress, it could be just a matter of updating to the latest versions.

      If its something custom you've downloaded or had written, you'll need to get someone who can check it.

      This is something _you_ have chosen to put on your server so its not your hosting companies job to fix it. Their job is to keep the servers running.

      They might have a programmer you can hire to do it, but I think the onus is on you to upload safe scripts.
      Signature

      "Jamroom is a Profile Centric CMS system suitable as a development framework for building entire communities. Highly modular in concept. Suitable for enterprise level development teams or solo freelancers."

      - jamroom.net
      Download Jamroom free: Download
      {{ DiscussionBoard.errors[4201034].message }}

Trending Topics