Site hacked again? - Navigator Internet Solutions, Inc

TonyB · #1 (**permalink**) 09-01-2006, 02:42 AM

Hey,

My site has been hacked by our old friend nET^Devil

. Can we please get this mess sorted out?

**NIS-Francisco** · #2 (**permalink**) 09-01-2006, 10:20 AM

Quote:

Originally Posted by TonyB

Hey,

My site has been hacked by our old friend nET^Devil

. Can we please get this mess sorted out?

Hi,

It was not hacked again, the most probable thing is that I restored your backup from the day the accounts were hacked, since I could not restore all accounts from the same day backup as the hard-drive died.

Anyways, the data has been recovered. I am going to be restoring the backup of the day of the hard-drive crash.

Please note you're on a new server, blueberry and that mainstream (server) will get taken down, shortly.

Don't worry as no-one has their website on mainstream becuase they were transfered last week.

I am restoring batesbryanwedding.com now. Let me know or open a ticket if the site doesn't work again.

Francisco

**NIS-Francisco** · #3 (**permalink**) 09-01-2006, 10:23 AM

Taking/making the backup of your account, I noticed:

Quote:

Grabbing mysql dbs............
mysqldump: Got error: 1017: Can't find file: 'ADDRESS.MYI' (errno: 2) when using LOCK TABLES
Done

This means that it is probable that one of your mySQL databases got affected when the hard-drive crashed.

NOT ALL the data on the mySQL database was lost, only the TABLE address.

Check and see if you had a backup.

Francisco

**NIS-Francisco** · #4 (**permalink**) 09-01-2006, 10:32 AM

Restored.

But the page (of the hacker) is still up. I am investigating.

From mainstream current:

PHP Code:


			
html>

<head>

<meta http-equiv="Content-Language" content="en-us">



<title>_|_Owned!! By nEt^DeViL_|_ For Lebanon !</title>

<script language="javascript">defaultStatus="!!!! Own3d By nEt^DeViL .. a Musli$

<style>

<!--

.page

{

        background: #FFFFFF;

        color: #000000;

}

That's index.htm

Quote:

root@mainstream [/home2/tony/public_html]# ls -la |grep index*
-r--r--r-- 1 tony tony 17583 Aug 11 05:54 index.htm
root@mainstream [/home2/tony/public_html]#

It was modified last 11 Aug. The server is the same.

My question is, since the hacking incident:

Did you restored the index.htm of your site AFTER the hacker replaced the index?
Do you have the backup of index.htm on your computer that you can upload?
Have you taken the neccesary security steps required after being hacked? Example: Changing cPanel passwords, site passwords?

Did you just notice about the hacker today, or did you knew from before? -- Because two of our customers on that server indeed got hacked and allowed the hacker to run malicious code on the server.

Link: My sites were hacked ... can't log in to cpanel

Thanks,
Francisco

**NIS-Francisco** · #5 (**permalink**) 09-01-2006, 10:39 AM

I have fixed your site. By removing the index.htm the home.html was intact so your site now works.

Bates-Bryan Wedding Home

Best wishes on the wedding BTW.

Let me know if I can be of further assistance.

Have a nice day.
GFMDS

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Hacked	Angel	Ofertas Especiales y Soporte Técnico	25	08-13-2006 05:00 PM
My sites were hacked ... can't log in to cpanel	k89mmk	Support & Questions	46	08-13-2006 12:30 AM
Alert! Hacked	Angel	Support & Questions	1	08-12-2006 04:02 PM
Someone hacked into my site	Bryan G	Support & Questions	4	11-23-2005 07:14 PM

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)