Re: What’s Going On!!!
gsaunders,
unix2 is web, it is the server this site is on. It is not realted to this defacement, just that it had an unrelated issue this morning.
Re: What’s Going On!!!
ok we will add logo*.* to the the of items needing restore. It is index.htm/php/html and default.html/htm/php that was overwritten and will be restored from backup.
Well… I have actually replaced all of our index.* files already as well as changed ALL passwords (CP,FTP,mySQL) and disabled frontpage.
So we should be good to go, but he also hit another file if you have wordpress. This file is ..\wp-includes\default-filters.php
I have customers using wordpress as well… thanks for telling us man!
See how nice it is to have a support forum at jodo! 8)
QuietCalm
all good infromation, seems it was default*.* instead of just what I had initially listed.
These also defaced:
- home*.*
- main*.*
I’ve been wondering about this (while trying to find out what happened prior to this post appearing) and in researching the web came accross the site www.zone-h.org where all our sites are listed as being hacked today.
Some of the ‘sites’ listed are domain aliases for other domains.
I’m assuming the hacker has notified Zone-H to ‘get credit’ but how does the hacker know exactly what sites were affected, including domain aliases?
reverse ip lookup
[QUOTE=com-du-it.com]
These also defaced:
- home*.*
- main*.*
I’ve been wondering about this (while trying to find out what happened prior to this post appearing) and in researching the web came accross the site www.zone-h.org where all our sites are listed as being hacked today.
Some of the ‘sites’ listed are domain aliases for other domains.
I’m assuming the hacker has notified Zone-H to ‘get credit’ but how does the hacker know exactly what sites were affected, including domain aliases?
[/QUOTE]
How long (approximately) can we expect the restore to be?
QuietCalm
Can we get you to fix the file manager/webshell index which was hacked, quick and first.. that way we can replace files easier then having to reset customer passwords, ftping etc. for thiose sites that we can replace the index file with original instead of waiting for the restore.> 
QuietCalm
working on the webshell now, good idea 
As for how long, it is running now. But you can also submit a ticket(ticket is priority over livechat) and we will process yours as we get to it, faster than automated may.
OK not being pushy.. just asking. I am out the door for holidays today and all..
Another one found… delete and replace files like index.phtml
Those were not deleted yet.
QuietCalm
http://web5.jodo Shared — the operating system for online-ordering companies(index.php forwards here)
You can of course put your service domain here as well.
[QUOTE=Stephen]
http://web5.jodo Shared — the operating system for online-ordering companies(index.php forwards here)
You can of course put your service domain here as well.
[/QUOTE]
Here is where it routes me and it still shows hacked…
I don’t want to sound negative, but the emails notifying me of posts to this thread are showing up WAY AFTER the posts have been made. My guess is there is a backed up queue somewhere? 
Saw the same thing yesterday with the email notifications on other threads too.
Check back often, it is getting updated a lot.
Just in general, email alerts on updated threads were arriving hours and hours later yesterday — probably totally unrelated but thought I’d let you know anyway.
FYI: All images beginning with the word “index” have been affected also…
I have a ticket open for 2 of my clients, and it says that the sites has been restored. But the index.php files are still missing. How old backup does Jodohost have of Web5 server?
If Jodohost only have backup for last 24 hours, what if the sites was hacked earlier (like 2 days ago).
My understanding is that JH keeps about a weeks worth of daily backups so previous versions should be available.