Some one is hacking my hosting. URGENT HELP!

If your hosting company is suspending your account and not temporarily removing the issue then it sounds to me like they are taking the easy route out and not giving you the kind of support you could get elsewhere. What do you pay? As it may be that the hosting package is so cheap that for them to "waste" any support time on it would be costly for them. This is the kind of situation where the term "you pay for what you get" comes into effect (i know there are exceptions etc).

Really the hosting company should be doing the following, although you could check your t&c's. Any less than this is quite lazy of the hosting company (this is what we do for our customers):

- Suspend the account upon detecting spam problem with an account.
- Email the customer immediately
- Get a tech to check over the account quickly, they should already know the script responsible if the server is set up and managed correctly!
- chmod and move that folder/scripts to a location outside the webroot but within the account. chmod/move any other weak/vuln scripts used to exploit.
- Unsuspend the account (problem temporarily fixed)
- Email the customer advising to take course of action.

To do the above is very easy and doesn't take long. If the hosting company isn't looking in to it for you, as per above, its very likely they don't know how to manage the server correctly, as they should be able to identify the script sending out spam immediately. I would be quite worried about the fact that your hosting company doesn't really know how to manage servers properly.

Good luck.

Hackers aren't that bad... And if i remember correctly nulled scripts usually have such things in them... Why you think most people like having the actuall course code... One last thing it wasn't a hidden line of code that doing this... Otherwise from day one it would have happened... Reset your password and the once you got access change the code to a 10 or more character password and use different codes and don't leave them in plain txt in a file or db. Trust me hashing the password using MD5 wil do the trick and most hackers wont bother with them... And change your code once a month... A hacker can crack a code after enough time.

lol at some of you guys..

------------------------------

the hacker has been spoofing your mail server / smtp gateway

using telnet probably putty its very easy to do, a good way to use someone elses and not yours, escpecially if its a good domain name..

1st use the logs ask your host to ban the originating ip.. but i wouldnt bother probably using a proxy..

2, make sure to check mail headers see if the hacker messed up

3, get ur host to read:

http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/security-guide/s1-server-mail.html

(assuming your server is on linux) if not pm me

SpyBoy said:

lol at some of you guys..

------------------------------

the hacker has been spoofing your mail server / smtp gateway

using telnet probably putty its very easy to do, a good way to use someone elses and not yours, escpecially if its a good domain name..

1st use the logs ask your host to ban the originating ip.. but i wouldnt bother probably using a proxy..

2, make sure to check mail headers see if the hacker messed up

3, get ur host to read:

http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/security-guide/s1-server-mail.html

(assuming your server is on linux) if not pm me

Click to expand...

Hi Spyboy,

i have forwarded this information to my host, hope to get everything right. Thanks for your help!

Here's the final email receive from them:-

-------------------------------------------
Basically, it's taking too much of our admin time to examine your site and we still can't
find any scripts.

At this point, you have two options.

1) Find a new host

2) Delete everything and recreate the account.
Thank You,

Jason Newman
Lead Associate
WebHostingPad.com

----------------------------------------------------

These people dont want to do anything, just to close my acocunt, i ask them for sometime to back file now i have 2 sites on there server so how will i backupthem as they are membership site with database?

Please guide me how to backup membership site with database?
please help asap...

Guys,

they gave me just 1 hr to backup everything, please help me, how to backup the data bses so that they can again be reinstalled to new host..

ok backup your site obviously, it seems the admins are half wits.. all they need to do is scan the logs in the smtp server of incoming connections, then to do a reverse dns against you and the admins, or who-else uses your domain accounts.. I personally would move with the attitude they have.. if you have cpanel goto files/backup and download your directory.. and sql database, if you need help asap, msn messenger me [email protected] I will help you bud,

apart from that tell your admin that you have a slow connection and it will take 3 hours or more to download, as your download rate is slow say 40kb/sec
so you need more time..

and download the server logs,

Post the suspected spam headers if they have them, and post us some apache logs from the same time period. Censor anything you dont want us to see, but it should hopefully narrow down which portion of your site is being exploited, or possibly the originating IP.

You might want to swap over to hostgator anyway. My sis runs her porn sites off of webhostingpad and they have been nothing but trouble. Her sites were randomly down every few minutes for 2 weeks straight once, and they never had any explaination other than "Oops, we made a mistake over here on our end". *sigh*

Hi carsonrathi, I sure hope you managed to get all your files out, It looks like they've closed your account at server211.webhostingpad.com/suspended.page/ I had something similar happen last month but luckily I found the hack before my hosting company realised and closed the hole, you've got to be as slick as these guys and check your sites regular, anything that looks suspicious, pull the page down and go through the code, compare it with the original files, or just re up the originals and change your passwords, check .htaccess as well for redirects and also check your mysql tables to see if anything has been added.

Hey Guys,

Thanks for your help, they closed my account even didn't give me an hour to backup, i know i lost my 5 sites including 2 membership sites, but they taught me valuable lesson, " Cheap is not always good", now guys suggests me some reliable webhosting company who can THEMSELVES take care of any hacking shit instead of asking customers to find it..

Thanks again.

FutureQuest.net is supposed to be VERY RELIABLE, but they will nickel and dime you to death. Meaning, for example, if you want to set up a redirect, they charge you $10 for doing so. If you want to move to a VPS, they charge you a fee to backup and move your files. However, the people that work there are VERY COMPETENT. They however do not offer cpanel, they have their own custom made control panel. I had hosting with them for awhile, but I left because I didn't have anything that was all that important so it wasn't worth the price to me. But if I had membership sites like you, I would be using them as my host, especially because I did lots of research on them, and I've never heard horror stories about them.

I feel bad for you man, I remember that guide you posted around the 1st of the year for building membership sites. I plan to use that one day, but I'm busy with other things now and I don't want to get off task.

Also, did you by any chance have a feedback form on your site? If so, there are ways that people can use your feedback form to send spam as well (but there are ways to secure it and prevent this also). I know that SpyBoy seems to have already figured out the problem, but I am stating this just in case, and for future reference.

As said before: try be your own master.
A dedicated server starts at 25$/month, you can host a lot of stuff there.

justone said:

As said before: try be your own master.
A dedicated server starts at 25$/month, you can host a lot of stuff there.

Click to expand...

Guys,

What if i buy my own servers, then do i need any webhosting company?
Servers here means physical servers at my office, is it possible?

host server is easy to build. the problem is only bandwidth and security matters.

carsonrathi said:

Guys,

What if i buy my own servers, then do i need any webhosting company?
Servers here means physical servers at my office, is it possible?

Click to expand...

Sure it is possible, but you will need a very good internet connection, at the very least a T1 connection. You won't be able to host anything substantial on a standard cable internet connection. A better option might be collocation, if you have another hacking/spam problem your server might be taken off line, but you will still have the hard drive and what not. Any host that is US based and thinks you are spamming is going to take you down, it is expensive and time consuming to get off of spam filters.

Personally I host everything I do offshore, on dedicated boxes so I don't deal with complaints often, when I get them though my servers are taken down before I even get the actual complaint. I do keep a backup of everything on my home computer and a cheap dedicated box that is unassociated with my blackhat stuff (just for the upload speed), so rebuilding everything I have on 20 servers takes less than a day.