What's Going On!!! [Web5 Hacked]

magenta, please give me a ticket number. I will check on this. I believe it is a permissions issue, if the file is owned by root you won’t be able to see it as being there.

Let’s try to stay on the issue for now, the email delay I do not have time to check right now, I will check it another day when I am not in disaster recovery mode. I am not trying to downplay it, but it is very minor at this time.

Why am I not able to FTP into web5 any longer? Also, when I try to use the file manager from the cp it also says it has been hacked??? Please advise as I am losing faith that you have this situation under control. The replies to my tickets keep saying that the domains I listed (as hacked) were fine, but that is becuase I replaced the files after the hack, but now I cannot FTP into the server, and fix the remaining files…

Ok, it looks like someone fixed the file manager, thanks. Please advise as to when we can FTP into web5 as I am assuming it is not just me…

the file manager is working now, has been for some time. Deepak is checking the FTP now.

Ok, it looks like someone fixed the file manager, thanks.

Well, the filemanager does not work. You are not able to browse the content

magenta seems to be correct, I cannot browse either…

the webalizer files have been affected too. the index page is missing…

It is not about being missing, it uses FTP to connect.

As a customer, It would be nice to know more about when Jodohost will fix the missing files. I need to get in touch with my customers and explain what happened (not look forward to this though)

But I would like to know, when the sites are being restored and everything should works fine.

I notice that index.shtml files have not been removed. They still display the hacker’s message. I am not able to access my customers’ sites by file manager or FTP to delete or replace it.

FTP is fully working again.

Please see this topic:
http://support.jodohost.com/showthread.php?t=8057

If you have any domains still having problems(should not be any) please either create or reply to a ticket on the subject matter.

I must have been one of the few that quickly fixed everything on a customers site, because as soon as we something was hacked (and before knowing it was everyone) we replaced ALL passwords, got rid of frontpage extensions and updated any software that could possibly be out of date.

I sent a ticket in asking that this clients domains NOT be messed with because we had already fixed all of the problems and upgraded some software. Again we didn’t know it was server wide when we fixed our stuff. We simply needed to react and try to stop all possible areas of attack.

Well… my ticket was either ignorned or missed, because we got a reply saying all my stuff was restored… and I specifically ask that this client not be restored.

Oh well… got another hour of refixing and reupdating.

The file manager still does NOT work.

When you click on a folder you should be taken into it. Instead you get javascript errors and nothing happens.

Both in IE and Firefox.

The errors say parent.cdir is not a function. I have gotten this on 4 computers and 3 browsers.

Please advise.

I checked webshell earlier and it was fine, but I am not sure that I clicked a folder, I know i clicked a file and got the permissions window when going to CHMOD.

As for the files, as Yash said we reverted to the backup, it was for the whole directory structure. I am sorry that we were unable to not revert your copy. Had Deepak and I seen that ticket we would have tried to exclude it. It looks like webshell was copied over with the wrong permissions from what I see now. I will assign a unix tech to correct this.

[QUOTE=Stephen]
I checked webshell earlier and it was fine, but I am not sure that I clicked a folder, I know i clicked a file and got the permissions window when going to CHMOD.

As for the files, as Yash said we reverted to the backup, it was for the whole directory structure. I am sorry that we were unable to not revert your copy. Had Deepak and I seen that ticket we would have tried to exclude it. It looks like webshell was copied over with the wrong permissions from what I see now. I will assign a unix tech to correct this.
[/QUOTE]

Thanks… I have re-fixed my client’s wordpress and site. All I know that is left is the file manager and we should be good to go.

Thanks.

Also I have noticed the forum being unavailable at times… is there something going on with it as well?

I have not seen a forum issue recently, but earlier there was some abuse matter on it. I don’t know details will leave that to yogesh or Tanmaya. Tanmaya just came into the office but has not had any sleep after a long train trip.

I am getting that same javascript error in the firefox console, but no errors on IE, what a change from the normal for me. IE works and firefox doesn’t. Tanmaya is still looking into this however.

All working now, but I did have to clear my cache on Firefox before it quit acting up with javascript errors.