Hosting Security?

[verbster]

Mods, not sure if this is the right place....

Over the past few months, I've received four e-mail notices from evuln[.]com that my "[mydomain] is most probably hacked." The e-mails seem to be right, as one domain, plangreen[.]com has been flagged by Google as unsafe. Two others, I just deleted everything, and the last, I'm not sure what to do.

My question is about how this is happening, and the host's part (or not) in the problem. In the evuln warning, it states:

"How to solve the problem.
Most likely you may find malicious redirects in:
1) .htaccess files
2) website scripts or html files
You should remove this code. So, you will cure symptoms. Then it is necessary to discover how these files were modified to prevent future infection. Usually this is possible because of website vulnerabilities or web-shells(backdoors) in neighbor sites on the same server." Is this true? If hackers get into one site on a shared server, can they then get into mine? My host is blue / host / com. Which I've been very happy with.

I've also read that some companies that send out the warnings are the hackers that create the problems. I don't know if this is true about evuln or not. They are up front about helping for a fee, if that means anything. Then again, the whois is privacy protected.

Your thoughts on this are appreciated.

The notification letter:

We have discovered that all visitors coming from search engines to [mydomain].com site are redirected to 3rd-party URL:
hxxp://pasix-gro(dot)ru/oiku?14

How to check this by yourself:
you may type "mydomain.com" in a search engine and click on some results with your website. Warning: be careful, malicious URL may infect your own PC.

What does it mean:
1) your website is hacked
2) your website looses all visitors from search engines
3) search engines will delete your site from search results soon (or already done this)
4) website will be blocked (or already blocked) by most of web browsers as harmful website

How to solve the problem.
Most likely you may find malicious redirects in:
1) .htaccess files
2) website scripts or html files
You should remove this code. So, you will cure symptoms. Then it is necessary to discover how these files were modified to prevent future infection. Usually this is possible because of website vulnerabilities or web-shells(backdoors) in neighbor sites on the same server.

Why we contact you.
We are a website security company. We are continuously checking websites' health and help their owners keep a clean reputation and stable e-business. We offer the service of fixing hacked websites.

Our checks and scans are completely safe.
We do several (usually 1-2) visits per month to a site like any search engine bot. This is absolutely safe and doesn't harm your website. If you don't want us to check your website â?" just contact us.

If you are not able to fix this "redirect" problem on your own then we will be glad to help you for a reasonable price.

Best regards,
Alex

 

[HappyDay]

I don t believe your host is insecure. But I can tell you I had a cheap, misconfigured host and my site was hacked and infected very soon.


If you have some knowledge it s normally easy to find these redirects in index.php or html files and .htaccess. You need to find out when this happend - check the server logfiles for this date. You will also need to find out if there are new unknown files on your server and if chmod is correctly set.
You need also to change all your passwords too. So there are a lot of things to do. I would also download everything and do a security scan.
Also your software needs to be up-to-date to prevent this in the future. If all this doesn´t help and there is still a security hole I would consider to ask for professional help. But it s expensive and you should trust only well known peoples.

I've also read that some companies that send out the warnings are the hackers that create the problems.

Yes, thats sometimes true.
Btw: I don´t know anything about the company you talked. Good luck !

 

[verbster]

Thanks for your reply and suggestions. It helps.

I've found that almost every site I had hosted on the server, about 100, were all hacked in the .htaccess file.

I was told by bluehost support to just delete the infected .htaccess files, so I did. I was told the files would replace themselves when someone accessed the site, but that doesn't appear to be the case.

Do you have any recommendations for sites that scan sites for vulnerabilities? Would appreciate it.

 

[HappyDay]

Do you have any recommendations for sites that scan sites for vulnerabilities? Would appreciate it.

No, I´m sorry.

 

[verbster]

If anyone out there knows what they are doing and can help me figure out where my site vlnerabilities are that are being exploited, I'm willing to pay for your help. If anyone knows of a site that checks for weak spots (not just already infected areas), I'd really appreciate it. This stuff is very frustrating. I delete all the infected .htaccess files in all my sites, and a day or two later, they are back and infected. It's getting old, and I'm worried I'll start getting blacklisted.

 

[RazorNF]

What type of scripts are you running? Are they all updated to the latest versions?

Check your master admin account, and change the passwords, make sure there are no ftp or shell accounts that shouldn't be there.

 

[verbster]

All the scripts i know of are updated. I've changed passwords three times in the last week. There is only one ftp account. I don't know about shell accounts.

What I'm thinking is there is an old script or something on one of the domains that is not being used but is still there . . . an old open realty or something. I'm just not sure how to find it, which is why I'm trying to find a vulnerability checker. I found a scanner that tells me what's wrong, but I'm not sure how to fix the stuff they found.
http://sitecheck.sucuri.net

For example, it says there is malware in 404.javascript.js

and shows an explanation and where it redirects.

I don't know how to fix that, but maybe I can look it up.

Each site has 4-5 things all redirected to the same Russian url, supposedly to infect others redirected there.

Here are the other locations in one site that the scanner says are infected:

[my domain]/site_pg.php?pg_id=3
[my domain]/gallery.php
[my domain]/site_pg.php?pg_id=20
And a "suspicious conditional redirect" which I think is the .htaccess file.

It's very frustrating.

 

[Kate]

Here are the other locations in one site that the scanner says are infected:

[my domain]/site_pg.php?pg_id=3
[my domain]/gallery.php
[my domain]/site_pg.php?pg_id=20
And a "suspicious conditional redirect" which I think is the .htaccess file.

Isn't it a phpnuke install ?
Make sure you have the most recent versions.
The core of the CMS may be safe, but vulnerabilities are often found in the third party plugins.

Perhaps you could try the Nikto scanner against your sites to find the weak spots that may be exploited.

 

[RazorNF]

Speaking of phpnuke, one of my first sites was built on that many many years ago, and it was hacked frequently.

Did not know they were still around. How often is it updated?

Unless you are a coder yourself, it may be time to ditch any scripts that aren't maintained regularly. Otherwise you will be at the mercy of the latest exploits that come out.

sdsinc is correct that plugins could also cause a problem. Reminds me of the Timthumb problem that affected many people who used Wordpress last year - some people might still be running plugins that have the bad code in it.

 

[HappyDay]

PM sent !

 

[verbster]

I'm happy to say that a very competent Namepros member helped me out with this.