Please help ! ! !

This is unfortunatley out of my league so some kind of help would be greatly appeciated.

I have been with the same Hosting Provider for the last 7 to 8 years and never had any problems, no problems with the 80 sites that I host nor with contacting support when I needed it. They are a small company, but up until now have been brilliant.

The other day I noticed that some of the sites I look after were suddenly jumping way over their disk limit and bandwidth limit.

I decided to have a nose to see if the client was up to something on their website but no, it looked all perfectly normal until I started digging deeper and started finding obscene links to forums etc all in very deeply burried files.

It was clearly nothing to do with them as over the weekend another five sites have started having all the same symptoms............

Now, suddenly I can't get through my Hosting Provider who has previously suppled 24/7 support without any problems at all.

They are only an hour up the road, as I have now spent over 5 hours on their 0800 support number ! ! ! !

I keep deleting all these links and folders but they either just come back over night or jump onto another site.

I have changed all the passwords that I can think of!

All my sites are spread over several ip addresses but this appears to not matter a jot!.

Any suggestions? As there is no help from my provider at the moment, are they worth a visit?

Could be a server level hack. So no matter of changing passwords is going to help.

Do you have a standard control panel such as cPanel or Plesk? Moving might be an option with a migration wizard.

Edit: looks like they are all Plesk hosted from the control panel being on the standard port.

Matt

Edited by deleted (Mon 21-Sep-09 14:46:23)

They are all on Plesk, which is the only one I know how to run efficiently, at the moment, although I feel a change coming on.

With this many sites, anyone with any ideas about who would be good to migrate to, probably an oft answered question, but I am sure it won't hurt to be asked again as this is now getting silly.

Whoever is doing this I would guess either is school age or has a job, because it only happens out of normal working hours !

I presume you have scripting support on your server and run some scripts of some kind be it a CMS system or forum etc etc. The first thing I would do is have a look at where the files are being made and what are the permissions at that level.

I'm guessing you will be running on a linux machine of some kind and will have ssh access or even on windows hosting with remote desktop?

If so go to where the files are and look at who actually owns the files and what permissions they have. IIf they are root:root there isn't much you an do as it looks more like a server level hack. However if they are made with your account you can set the permissions on the directory where the files start to read only so then no files can be made in there as standard.

As people say it could be a server level hack in that case you cant really do anything as they probably have got more permissions than you have.

In reply to a post by Etchy:

If so go to where the files are and look at who actually owns the files and what permissions they have. IIf they are root:root there isn't much you an do as it looks more like a server level hack. However if they are made with your account you can set the permissions on the directory where the files start to read only so then no files can be made in there as standard.

And if the server isn't running some sort of user level security like suPHP, you may have files written by other users, (or even the web server) both of which you won't be able to delete if you don't own.

Matt

Edited by deleted (Mon 21-Sep-09 17:13:17)

Regardless of whether I have updated them or he/she has updated the files and directories, they still use the same username and group details, there is no difference, but at least they are not root !

All passwords have been changed, so it can't be somethng as simple as that

I am able to delete them, but as fast as I take them down on one site he/she is putting them up on another site, and they are sick, I will start checking permissions, but to be honest, it just looks like I have put them up there!

In reply to a post by TrevorSP:

They are all on Plesk, which is the only one I know how to run efficiently, at the moment, although I feel a change coming on.

With this many sites, anyone with any ideas about who would be good to migrate to, probably an oft answered question, but I am sure it won't hurt to be asked again as this is now getting silly.

Whoever is doing this I would guess either is school age or has a job, because it only happens out of normal working hours !

If you plan to change - and depending on how many sites, it may be worth going for a reseller or vps package, or finally move over to a dedicated server.

In reply to a post by TrevorSP:

Regardless of whether I have updated them or he/she has updated the files and directories, they still use the same username and group details, there is no difference, but at least they are not root !

All passwords have been changed, so it can't be somethng as simple as that

I am able to delete them, but as fast as I take them down on one site he/she is putting them up on another site, and they are sick, I will start checking permissions, but to be honest, it just looks like I have put them up there!

I would check for permissions, you can do this via ftp or ssh .. If it is root:root then there will be not alot that ucan do about it untill the host sorts it out.

There is sadly php scripts out their which have one touch access to ssh, and various buttons to do nasty things to a server.

None of them are root updated, thank goodness and the "Support Team" are now looking into it.

However, Tara is absolutely correct, it is time for a move, getting hold of this lot has become worse and worse over the years ! !

I have been with them seven years, through teething problems when they first started up and growing pains, but nothing like this, I suspect that Plesk has NOT got all the patches installed and that is why someone has managed to get in, but that is just my opinion after getting IMMEDIATE replies direct from PLESK themselves!

I am now thinking of moving over to Linux and cPanel. Would this be a sharp learning curve ???????? Anyone?

In reply to a post by TrevorSP:

None of them are root updated, thank goodness and the "Support Team" are now looking into it.

However, Tara is absolutely correct, it is time for a move, getting hold of this lot has become worse and worse over the years ! !

I have been with them seven years, through teething problems when they first started up and growing pains, but nothing like this, I suspect that Plesk has NOT got all the patches installed and that is why someone has managed to get in, but that is just my opinion after getting IMMEDIATE replies direct from PLESK themselves!

I am now thinking of moving over to Linux and cPanel. Would this be a sharp learning curve ???????? Anyone?

cpanel is pretty easy to use.

Demo at their website:
http://cpanel.net/products/cpanelwhm/try-demo.html

if you want to play with proper demo account I can set one up for you.. would be like 50mb space and 50mb tranfers for you play around with for a couple of days.

Not saying much more on that due to forum rules.

Oh meh name is Taras not Tara .. Not sure if i want to grow moobs .