| Question: |
Hello. When you try to log on www.ledshop59.ru out ошибкаForbiddenYou don`t have permission to access / on this server.Additionally, a 403 Forbidden error was encountered while trying to use an an ErrorDocument to handle the request. |
| Answer: |
Hello. what kind of newsletter You now performed? proc 692815 dvdauto 525809514 11u IPv4 0t0 TCP tisza.hostven02.EN:49362->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 14u IPv4 0t0 TCP 525817134 tisza.hostven02.EN:49375->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 17u IPv4 0t0 TCP 525817149 tisza.hostven02.EN:49392- > smtp in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 23u IPv4 0t0 TCP 525817404 tisza.hostven02.EN:42339->mxpool01.netaddress.usa.net:smtp (ESTABLISHED)
proc 692815 dvdauto 33u IPv4 0t0 TCP 525817166 tisza.hostven02.EN:49409->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 34u IPv4 0t0 TCP 525809510 tisza.hostven02.EN:53891->etb-3.mail.tiscali.it:smtp (ESTABLISHED)
proc 692815 dvdauto 41u IPv4 0t0 TCP 525816296 tisza.hostven02.EN:53873- > etb-3.mail.tiscali.it:smtp (ESTABLISHED)
proc 692815 dvdauto 43u IPv4 0t0 TCP 525809516 tisza.hostven02.EN:49366->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 45u IPv4 0t0 TCP 525817137 tisza.hostven02.EN:49380->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 46u IPv4 0t0 TCP 525817208 tisza.hostven02.EN:44840->fpo.mail.dk:smtp (ESTABLISHED)
proc 692815 dvdauto 51u IPv4 0t0 TCP 525817427 tisza.hostven02.EN:49689->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 52u IPv4 0t0 TCP 525817139 tisza.hostven02.EN:49383->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 53u IPv4 0t0 TCP 525817151 tisza.hostven02.EN:49395->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 54u IPv4 0t0 TCP 525817158 tisza.hostven02.EN:49402->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 55u IPv4 0t0 TCP 525817418 tisza.hostven02.EN:44932->al-ip4-mx-vip1.prodigy.net:smtp (ESTABLISHED)
proc 692815 dvdauto 56u IPv4 0t0 TCP 525817430 tisza.hostven02.EN:42362->mxpool01.netaddress.usa.net:smtp (ESTABLISHED)
proc 692815 dvdauto 525809512 5u IPv4 0t0 TCP tisza.hostven02.EN:53897->etb-3.mail.tiscali.it:smtp (ESTABLISHED)
proc 692815 dvdauto 6u IPv4 0t0 TCP 525809518 tisza.hostven02.EN:49372->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 7u IPv4 0t0 TCP 525816302 tisza.hostven02.EN:49341->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 8u IPv4 0t0 TCP 525817141 tisza.hostven02.EN:49385->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692815 dvdauto 525816293 9u IPv4 0t0 TCP tisza.hostven02.EN:53868->etb-3.mail.tiscali.it:smtp (ESTABLISHED)
proc 692816 dvdauto 10u IPv4 0t0 TCP 525818078 tisza.hostven02.EN:48786->bay0-mc5-f.bay0.hotmail.com:smtp (SYN_SENT)
proc 692816 dvdauto 13u IPv4 0t0 TCP 525815226 tisza.hostven02.EN:48792->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)
proc 692816 dvdauto 14u IPv4 0t0 TCP 525815227 tisza.hostven02.EN:48793->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)
proc 692816 dvdauto 525818081 15u IPv4 0t0 TCP tisza.hostven02.EN:48789->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)
proc 692816 dvdauto 17u IPv4 0t0 TCP 525821009 tisza.hostven02.EN:50170->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692816 dvdauto 18u IPv4 0t0 TCP 525809643 tisza.hostven02.EN:54713->etb-3.mail.tiscali.it:smtp (ESTABLISHED)
proc 692816 dvdauto 19u IPv4 0t0 TCP 525818979 tisza.hostven02.EN:59876->al-ip4-mx-vip2.prodigy.net:smtp (ESTABLISHED)
proc 692816 dvdauto 20u IPv4 0t0 TCP 525809653 tisza.hostven02.EN:60948->ff-ip4-mx-vip1.prodigy.net:smtp (ESTABLISHED)
proc 692816 dvdauto 23u IPv4 0t0 TCP 525818070 tisza.hostven02.EN:60959->ff-ip4-mx-vip1.prodigy.net:smtp (ESTABLISHED)
proc 692816 dvdauto 26u IPv4 0t0 TCP 525815238 tisza.hostven02.EN:48809->bay0-mc5-f.bay0.hotmail.com:smtp (SYN_SENT)
proc 692816 dvdauto 27u IPv4 0t0 TCP 525818068 tisza.hostven02.EN:34235->extmail.optusnet.com.au:smtp (SYN_SENT)
proc 692816 dvdauto 28u IPv4 0t0 TCP 525815234 tisza.hostven02.EN:44266- > mx3.mail.icloud.com:smtp (SYN_SENT)
proc 692816 dvdauto 29u IPv4 0t0 TCP 525809644 tisza.hostven02.EN:54714- > etb-3.mail.tiscali.it:smtp (ESTABLISHED)
proc 692816 dvdauto 31u IPv4 0t0 TCP 525815228 tisza.hostven02.EN:47299- > mta-v1.mail.vip.gq1.yahoo.com:smtp (SYN_SENT)
proc 692816 dvdauto 32u IPv4 0t0 TCP 525815235 tisza.hostven02.EN:48803->bay0-mc5-f.bay0.hotmail.com:smtp (SYN_SENT)
proc 692816 dvdauto 33u IPv4 0t0 TCP 525815230 tisza.hostven02.EN:47301- > mta-v1.mail.vip.gq1.yahoo.com:smtp (SYN_SENT)
proc 692816 dvdauto 34u IPv4 0t0 TCP 525815236 tisza.hostven02.EN:48804- > bay0-mc5-f.bay0.hotmail.com:smtp (SYN_SENT)
proc 692816 dvdauto 35u IPv4 0t0 TCP 525815237 tisza.hostven02.EN:53183->mail-bpa.bigpond.com:smtp (SYN_SENT)
proc 692816 dvdauto 525818073 36u IPv4 0t0 TCP tisza.hostven02.EN:48780->bay0-mc5-f.bay0.hotmail.com:smtp (SYN_SENT)
proc 692816 dvdauto 37u IPv4 0t0 TCP 525809652 tisza.hostven02.EN:60947->ff-ip4-mx-vip1.prodigy.net:smtp (ESTABLISHED)
proc 692816 dvdauto 38u IPv4 0t0 TCP 525818074 tisza.hostven02.EN:48781->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)
proc 692816 dvdauto 39u IPv4 0t0 TCP 525818076 tisza.hostven02.EN:48783->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)
proc 692816 dvdauto 40u IPv4 0t0 TCP 525821005 tisza.hostven02.EN:50169->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692816 dvdauto 42u IPv4 0t0 TCP 525821015 tisza.hostven02.EN:50171->smtp-in.orange.fr:smtp (ESTABLISHED)
proc 692816 dvdauto 43u IPv4 0t0 TCP 525818077 tisza.hostven02.EN:48785->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)
proc 692816 dvdauto 44u IPv4 0t0 TCP 525818079 tisza.hostven02.EN:45454->al-ip4-mx-vip1.prodigy.net:smtp (ESTABLISHED)
proc 692816 dvdauto 45u IPv4 0t0 TCP 525815225 tisza.hostven02.EN:48791->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)
proc 692816 dvdauto 46u IPv4 0t0 TCP 525815229 tisza.hostven02.EN:47300- > mta-v1.mail.vip.gq1.yahoo.com:smtp (SYN_SENT)
proc 692816 dvdauto 47u IPv4 0t0 TCP 525815231 tisza.hostven02.EN:47302 -- > mta-v1.mail.vip.gq1.yahoo.com:smtp (SYN_SENT)
proc 692816 dvdauto 48u IPv4 0t0 TCP 525815232 tisza.hostven02.EN:47303- > mta-v1.mail.vip.gq1.yahoo.com:smtp (SYN_SENT)
proc 692816 dvdauto 4u IPv4 0t0 TCP 525818980 tisza.hostven02.EN:59877->al-ip4-mx-vip2.prodigy.net:smtp (ESTABLISHED)
proc 692816 dvdauto 50u IPv4 0t0 TCP 525815247 tisza.hostven02.EN:47812->mta-v3.mail.vip.ne1.yahoo.com:smtp (SYN_SENT)
proc 692816 dvdauto 525815233 5u IPv4 0t0 TCP tisza.hostven02.EN:53179->mail-bpa.bigpond.com:smtp (SYN_SENT)
proc 692816 dvdauto 525809654 6u IPv4 0t0 TCP tisza.hostven02.EN:60949->ff-ip4-mx-vip1.prodigy.net:smtp (ESTABLISHED)
proc 692816 dvdauto 7u IPv4 0t0 TCP 525813329 tisza.hostven02.EN:47317->bay0-mc5-f.bay0.hotmail.com:smtp (SYN_SENT)
proc 692816 dvdauto 525809651 8u IPv4 0t0 TCP tisza.hostven02.EN:45556->fpo.mail.dk:smtp (ESTABLISHED)
proc 692816 dvdauto 9u IPv4 0t0 TCP 525809655 tisza.hostven02.EN:60951->ff-ip4-mx-vip1.prodigy.net:smtp (ESTABLISHED) |
| Answer: |
Hello. did You do any changes on the website? |
| Question: |
No distribution was not performed, changes over the last 3 days was not |
| Answer: |
Your sites are infected. You need to fix the problem http://dvd-auto.ru/AI-BOLIT-REPORT-__-813558-23-05-2016_12-34.html the scan report Your account |
| Question: |
Yeah, found a few files and directories for suspicious files. All was removed. How to check remained that or not? |
| Answer: |
You now continue that to send. the problem is checked. Restricted access to ascertain problems |
| Question: |
Open the FTP access though.. I go through everything |
| Answer: |
with the active account sletta spam. expect we check the |
| Answer: |
access is opened |
| Question: |
Good day.. Like all the suspicious scripts are removed, you can check? |
| Answer: |
Create amps. the claim is to scan in Your personal account, section \"Check the website for viruses\". |
| Question: |
created applications for ledshop59.ru and for dvd-auto.ru |
| Answer: |
the sites are checked |
| Question: |
Came notification that the sites are updated, but reports have not come |
| Answer: |
Check the amps. under spam. Maybe the letter got there. |
| Question: |
there is no report spam |
| Answer: |
the report can be viewed here http://dvd-auto.ru/AI-BOLIT-REPORT-__-775175-24-05-2016_08-58.html |
| Question: |
Now spam is not sent? |
| Answer: |
not now. but the virus is, you need to resolve |
| Question: |
All files deleted, sent in a request to check for viruses. Enable access to the website, please |
| Answer: |
please Wait. |
| Answer: |
the new report scan sites http://dvd-auto.ru/AI-BOLIT-REPORT-__-668279-24-05-2016_15-55.html |
| Question: |
All deleted, except libmail.php. This is a script to send emails, there is nothing suspicious in it have not found. |
| Question: |
turn on please website for sharing.. |
| Answer: |
utochnyat what have you done besides removal? you`ve eliminated the vulnerability? changed passwords? |
| Question: |
which passwords you need to change? From FTP? |
| Question: |
How to eliminate vulnerabilities honestly don`t know |
| Answer: |
all passwords. passwords account, passwords, the site administrator. |
| Question: |
Can`t reset the password from CPanel.. writes - is not a valid email address. mail |
| Question: |
though all notifications is on this post |
| Answer: |
What error gives you? What`s the password you specify? |
| Question: |
When you reset the password asks you to specify the email address. mail http://clip2net.com/s/3yqTEhA |
| Answer: |
What`s the password you specify in cPanel? |
| Question: |
I can then change? |
| Answer: |
the Request is sent to the developers. Please wait. |
| Answer: |
To change the password in cPanel, You need to authorize it and through the Change password. To change the password of the billing system, use the Profile.
Please set complex passwords with numbers and upper case letters.
|
| Question: |
can`t log in with old credentials. Writes http://clip2net.com/s/3yqW0DM You can establish a temporary password that I can change? |
| Answer: |
Details sent to [email protected]
|
| Answer: |
the Password reset to the password in the billing. |
| Question: |
All passwords changed, please access the website |
| Answer: |
141dd14b0b.php is your file? |
| Question: |
no, it`s a virus.. where did they come from? |
| Question: |
and ledshop59 appeared 9aa65b71ae.php |
| Answer: |
this file has been downloaded`s fixing to 2016-05-24 12:13: |
| Answer: |
that in the log 80.87.205.104 - - [24/May/2016:12:13:10 +0300] \"POST /141dd14b0b.php?test_url=true HTTP/1.0\" 200 102 \"-\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.109 Safari/537.36\" this same ip has requested a lot of things the log sent to [email protected] |
| Question: |
Apparently in feng some sort of hole.. I have these scripts removed |
| Answer: |
this script was not in the report. proverit again all scripts |
| Question: |
It seems like everything looked suspicious.. all removed |
| Answer: |
we again scan |
| Question: |
OK.. if all goes well, then immediately open access |
| Question: |
have you checked for viruses? |
| Question: |
Please include the site for public access.. customers will be lost, and Yandex think poorly perceived fields and lower in the results |
| Answer: |
open access |
| Question: |
Good evening. I`ve just tried to visit the site ledshop59.ru from another computer (another IP) writes access error |
| Answer: |
What kind of error? |
