| Question: |
Hello!When you try to go to my site engineer-history.ru the message \"Account blocked\". Money into personal accounts while there is (at 65 days). Tell me, what`s the matter? |
| Answer: |
Hello in your account the detected malicious files that led to blocking the ip of the server read more tut https://threatpost.com/attackers-using-compromised-web-plug-ins-in-cryptophp-blackhat-seo-campaign/109505 http://blog.fox-it.com/2014/11/26/cryptophp-a-week-later-more-than-23-000-sites-affected/ files detected specialized scriptom https://github.com/fox-it/cryptophp/tree/master/scripts /home/baga/public_html/engineer-history.ru/wp-content/plugins/Ninja-Popups/img/social.png: CRYPTOPHP DETECTED!
/home/baga/public_html/engineer-history.ru/wp-content/themes/simplemag.back/social.png: CRYPTOPHP DETECTED!
/home/baga/public_html/engineer-history.ru/wp-content/themes/simplemag.back/social0.png: CRYPTOPHP DETECTED!
/home/baga/public_html/wp-content/themes/emptiness/social.png: CRYPTOPHP DETECTED!
/home/baga/public_html/wp-content/themes/emptiness/social1.png: CRYPTOPHP DETECTED!
/home/baga/public_html/wp-content/themes/emptiness/social0.png: CRYPTOPHP DETECTED! |
| Question: |
what to do now? |
| Answer: |
your account will be migrated to another server. there you remove all those themes and plugins and smenet all passwords, just check the whole site |
| Question: |
good transfer, please |
| Question: |
can you please move back a backup of the website from October 23, 2014 |
| Answer: |
you have this backup? |
| Question: |
no. I thought backups are made you avtomaticheskie or, for example, a backup from the 8th of October (to which you`d roll me a website October 23) |
| Answer: |
there are files on the 23rd , he was there as infected. |
| Question: |
earlier bekapa?on the 8 th day? |
| Answer: |
the earliest backup no backup in the singular. and most likely these files even before you have only recently been able to find them. in the first message there is a link to a description of the problem |
| Answer: |
the account is transferred.
Details sent to EMAIL wait for the DNS updates. don`t forget to change passwords and clean up sites |
| Answer: |
did you change DNS? |
| Question: |
Hello. no.and how is it done? |
| Answer: |
you need to change the DNS of the domains registered not with us on the website of your Registrar, where you bought them. |
| Question: |
Hello.domains registered by you. current ns-s match sent me почтуns1.hostfordns.ru : IP ns2.hostfordns.ru : Vredonosnaya files removed. try to restore the site, just need to start to earned domain http://engineer-history.ru/поправьте me if I have something not completed |
| Answer: |
please Do a trace to Your domain: start - run - enter cmd - in the black window enter tracert YOUR DOMAIN - after click to highlight - making enter - skopirovat here in the ticket
If You are experiencing zatrudina, view instructional videos http://ded07.net/helphost/tracert.htm |
| Question: |
Tracing route to engineer-history.ru [IP]with the maximum number of jumps 30: 1 <1 MS <1 MS <1 MS IP 2 * * * timed out for the request. 3 19 ms 15 ms 22 ms IP 4 16 ms 16 ms 17 ms te2-1.ccr01.kbp01.atlas.cogentco.com [IP] 5 34 ms 34 ms 34 ms te0-0-0-4.ccr21.bts01.atlas.cogentco.com [IP] 6 36 ms 36 ms 36 ms be2222.ccr21.vie01.atlas.cogentco.com [IP] 7 42 ms 42 ms 42 ms be2200.ccr21.muc01.atlas.cogentco.com [IP] 8 48 ms 47 ms 49 ms be2228.ccr41.fra03.atlas.cogentco.com [IP] 9 56 ms 55 ms 55 ms be2261.ccr41.ams03.atlas.cogentco.com [IP] 10 135 ms 135 ms 135 ms be2194.ccr41.lon13.atlas.cogentco.com [IP] 11 135 ms 135 ms 135 ms be2317.ccr41.jfk02.atlas.cogentco.com [IP] 12 138 ms 138 ms 138 ms be2148.ccr21.dca01.atlas.cogentco.com [IP] 13 149 ms 149 ms 149 ms be2168.ccr41.atl01.atlas.cogentco.com [IP] 14 164 ms 164 ms 163 ms be2172.ccr21.iah01.atlas.cogentco.com [IP] 15 164 ms 164 ms 164 ms be2145.rcr12.iah02.atlas.cogentco.com [IP] 16 164 ms 164 ms 164 ms te0-0-2-3.nr11.b023723-0.iah02.atlas.cogentco.com [IP] 17 164 ms 164 ms 164 ms IP 18 171 ms 171 ms 171 ms IP 19 164 ms 165 ms 164 ms IP 20 170 ms 170 ms 170 ms 192-185-78-28.unifiedlayer.com [IP]Trace complete. |
| Answer: |
you have the domain with the faithful. the ip . specify what is the problem with this domain |
| Question: |
there was a website for the virus domain (or ip) has been blocked (see correspondence above). now hosting just index.html all pakistano when entering the site I see Default Web Site Radenac only work site - I want to pour already cleaned backup site - poudalyat all the suspicious plugins, leaving only the subject. and see whether it work. |
| Answer: |
and all I see here is this http://tools.pingdom.com/fpt/#!/tu9CV/engineer-history.EN clear browser cache |
| Question: |
Zdravstvoytsya I began to be displayed correctly only after clearing the cache of the browser.now the question is: why is this happening? the problem in the settings of the website or the hosting settings? in the future, how can I avoid this? now all my regular visitors should also clear the cache? |
| Answer: |
Settings are also cached in the browser. You have installed the caching on the website? |
| Question: |
the website on WP - I don`t know, maybe in the theme settings and installed |
| Answer: |
the Plugin is installed directly to the engine. You have the plugin wp-super-cashe? |
