| Question: |
Good time!Dr. Web started to swear on the site. Writes :\"Object\",\"Threat\",\"Action\",\"Path\",\"\"\"favicon.ico\",\"SCRIPT.Virus\",\"Zablokirovan\",\"http://okprint.by/favicon.ico\"Can check hosting for viruses? |
| Answer: |
Hello. you vessel
/home/okprint/public_html/wp-content/plugins/configv/config.php: PHP.Shell-38 FOUND
the site is 100% infected check the website of the antivirus http://www.revisium.com/ai/ or refer to them as consultations |
| Question: |
ok. can backup please. |
| Answer: |
Check the website of the antivirus http://www.revisium.com/ai/ |
| Question: |
I`m sorry, does not work, could I ask you to do it?I will not let even to your hosting via ftp total comander!!! What is it?So same question, how it happened and how to avoid it in the future, is on the hosting there is no antivirus? |
| Answer: |
please Make a trace to Your domain: start - run - enter cmd - in the black window enter tracert YOUR DOMAIN - after-click to select - enter to get to skopirovat here in the ticket
If You are zatrudina, watch a training video http://ded07.net/helphost/tracert.htm |
| Question: |
Tracing route to okprint.by [46.29.2.45]with a maximum of 30 hops: 1 <1 MS <1 MS <1 MS 192.168.1.1 2 16 ms 16 ms 54 ms 37.215.0.1 3 18 ms 15 ms 15 ms 100ge.core.belpak.by [93.85.81.53] 4 * 22 ms 13 ms mgts.10g.net.belpak.by [93.85.253.141] 5 38 ms * 53 ms ie2.net.belpak.by [93.85.80.54] 6 24 ms 15 ms 43 ms asbr1.net.belpak.by [93.85.80.98] 7 31 ms 31 ms 63 ms 85.26.172.42 8 121 ms 99 ms 72 ms 10.222.240.5 9 85 ms 86 ms 82 ms amsix.as6663.net [195.69.144.121] 10 70 ms 70 ms 69 ms 31.210.11.38 11 69 ms 69 ms 71 ms hostven03.com [46.29.2.45] |
| Answer: |
access problems you have no
Details sent to [email protected]
|
| Question: |
Comes but through time. Very strange. What about the rest? |
| Answer: |
here is a test of your website http://sitecheck2.sucuri.net/results/okprint.by |
| Question: |
OK, what transmission, how to fix it, and how to prevent in the future? |
| Answer: |
you WP, a quite popular cms for hacking. hacking could occur either because of a free template with a built-in BSOD or through brute force of password and using many ways known to the hackers. you can check the website script http://www.revisium.com/ai/ also order their treatment and Consolazio for the protection of the site first of all change your passwords, all passwords, and PowerJet your computer for viruses |
| Question: |
Hello! Continuing the theme about the hacking of our website. Turned in revisium.com. They cleaned, Here`s advice which is asked to do:To protect against the hacking to work, You need vypanasenko simple steps, since we do not have the necessary data or accesses configurationname files.1. Prescribe secure settings for php To make your site protected from hacking, you need to switch it to mode php-cgi or fast-cgi. Then there is the chance to ask personal bezopasnosti php for the site in php.ini.Contact the tech support of your hosting or server administrator chtobyoni performed these actions. In php.ini file, add the following: cgi.fix_pathinfo=Off allow_url_fopen=Off allow_url_include=Off expose_php=Off ;magic_quotes_gpc=On register_globals=Off disable_functions = popen,exec,system,passthru,proc_open,shell_exec,ini_restore,dl,symlink,chgrp,putenv,getmyuid,fsockopen,posix_setuid,posix_setsid,posix_setpgid,posix_kill,apache_child_terminate,chmod,chdir,pcntl_exec,phpinfo,virtual,proc_close,proc_get_status,proc_terminate,proc_nice,getmygid,proc_getstatus,proc_close,escapeshellarg,show_source,pclose,safe_dir,dl,ini_restore,chown,chgrp,shown_source,mysql_list_dbs,get_current_user,getmyid,leak,pfsockopen,get_current_user,ftp_exec,syslog,phpcredits display_errors=off mail.add_x_header=On After this the settings will be applied .the htaccess files .php .ity, templates be protected from unauthorized changes,becomes impossible also download and execute malicious code to system directories. In detail this protection against tampering is described on the page: http://www.revisium.com/ru/clients_faq/#q4 Attention! setting expose_php and disable_functions can be set only in php.ini, via .htaccess file they don`t change. If after specifying the list of disabled functions in disable_functions satiriste to work, try to specify a minimal set of functions disable_functions=popen,exec,system,passthru,proc_open,shell_exec,chmod,phpinfo If the hosting isn`t able to make these settings in php, the protection will not work and the site will remain vulnerable. So you need liberati on the rate, which will allow you to perform these settings, libparent site more functional hosting (beget.ru, sweb.ru, masterhost.ru,timeweb.ru etc.) to Check, apply the settings or not, as follows: setdatafile testqwer12x34.php in your website`s root directory with the contents: If once the page is open you see long blue page inastronomy PHP and proprietary information, then the settings from php.ini neprimenuli, we still need to write those support hosting. If you vidyamurthy page, then settings is applied. Don`t forget to remove файлtestqwer12x34.php. |
| Answer: |
Hello. all these nastroiki on the server are by default |
| Question: |
Thank you! |
| Answer: |
and you uvereny that your site will be fully functional after such restrictions as disable_functions = popen,exec,system,passthru,proc_open,shell_exec,ini_restore,dl,symlink,chgrp,putenv, getmyuid,fsockopen,posix_setuid,posix_setsid,posix_setpgid,posix_kill,apache_child_t erminate,chmod,chdir,pcntl_exec,phpinfo,virtual,proc_close,proc_get_status,proc_ter minate,proc_nice,getmygid,proc_getstatus,proc_close,escapeshellarg,show_source,pclo se,safe_dir,dl,ini_restore,chown,chgrp,shown_source,mysql_list_dbs,get_current_user ,getmyid,leak,pfsockopen,get_current_user,ftp_exec,syslog,phpcredits display_errors |
| Question: |
Not sure, can`t log in admin panel. Writes: page not found. Probably need to return to how it was. |
| Answer: |
what is the address you enter in the admin panel? |
|
