Possible Hacker - Files being deleated.

[.calidisaster]

I was about to upload some layouts to my site and I was using SMART FTP, as always, then all of a sudden, ALL my files were being deleated, out of nowhere.

I just though it was the FTP acting up, but then when I viewed my site, files WERE deleated. Couple days a ago, I backed my files to my computer, so all is good :]

I changed my password, and contacted my hosting company to make sure no third party was ACUALLY accessing my site. Now all of a sudden my site is being REALLY slow....

Is it possible it was a hacker got into my site? If so, how would I know? How can I prevent it happening the furture?

[Melly]

WOW sounds like it, hmmm, wait for your host to get back with you, are you giong through an actual host, or is someone who has went through an actual host, hosting your site from there host?

The host will search the ips that have accessed ur FTP. Unless there is another way, which I doubt there is.

[.calidisaster]

are you giong through an actual host, or is someone who has went through an actual host, hosting your site from there host?



Not sure what you mean. Are you talking did I contact my main hosting company?

[Melly]

Some people host sites and there url is in a subdomain, not really sure how else to explain it... Did you buy ur hosting or are you being hosted by a friend? (I guess that would be logical?)

[.calidisaster]

Oh, I see what you mean :]
No, I'm hosted my Surpass hopefully they'll be able to tell me what happened.

[shayna107]

if you didn't delete your files accidently it is definitely a hacker. hosting companies don't play with files. they would stop the web server process b4 tampering with files. you may have had your file permissions set improper or are using an insecure script possibly your ftp password was hacked i like to make all my passwords 16 characters long with upper case lower case number and letters combined it does look like your missing files tho. who is your host?

[CharmRoyal]

Yeah your site is going really slow :(

Hope you get it all sorted though (L)

[.calidisaster]

Surpass. Yeah, I was wandering how they could of gotten my password.
b/c once I found out my files were being deleated, I X'ed out of SmartFTP, then when I signed back on to see IF it was REALLY doing it, it was. I pressed the STOP button, and it wouldnt let me stop the process.

I deleated SmartFTP, and redownloaded the newer version just to make sure :]. Changed my password also, super harder now :]

Thanks, CharmRoyal. I hope so too.

[Enigmacsg]

You can use this online tool to generate a strong secured password.

http://www.pctools.com/guides/password/

Are u running a resource script?

[apple]

are u using the free ftp or maybe a cracked ftp?

[Melly]

Smart FTP is free.

What is ur site url?

[.calidisaster]

I'm using free ftp - SmartFTP. So I would think that it would have been pretty safe.

[.calidisaster]

http://www.alluredesigns.org
running REAL slow. Not even working now.

[Melly]

http://www.alluredesigns.org
running REAL slow. Not even working now.

*sigh* that really sucks... Did you have a site back up?

Wait it loaded for me, and from what I see everything is working... but I hadn't went further then the front page lol... Thats a sign of hope though, right?

[shayna107]

you night want to check for human error on ur side first, I'm not saying you did it, but it sounds kinda like maybe a shortcut key was pressed on your end (client FTP) to start the delete process or something. b4 you submit a ticket or w/e to your host i think you should be kinda sure there was an actual incident.

whether or not an accident, that sux, sorry :( hope you had your site backed up
recently.

[.calidisaster]

Yes, I have everything backed up, thank goodness.

It keeps, working, then now working, loading slow, then loading fast for some reason. It's done this before, but not for this long!

[.calidisaster]

you night want to check for human error on ur side first, I'm not saying you did it, but it sounds kinda like maybe a shortcut key was pressed on your end (client FTP) to start the delete process or something. b4 you submit a ticket or w/e to your host i think you should be kinda sure there was an actual incident.

whether or not an accident, that sux, sorry :( hope you had your site backed up
recently.

Ohhh, no it wasen't me I know for sure. Because I had just logged in, and everything was just being delated, I didn't even know till a few moments later.
But thanks though :]

[Kasami2k4]

Sounds like some jealous little asshole got ahold of your info :\

Also.. Is it me.. Or does it seem like a ****load of people being hosted by surpass have been hacked in the past few days?

[bronzy]

I can tell by your description that you were hacked, check your logs for last sign in to ftp and cp panel, look for any unusual script or file/s in your folders, tedious but check all of them, also do not only change you ftp password, change ALL OF THEM, if you have a good host they will check you files and try to see the source of the intrusion, but in most cases these are very hard to trace, the most they can do is backup to an earlier file, change your password, and tell you to remove all files or scripts that you are not using and to make sure you are using an updated script(if you are using any). good luck

[dustin]

Site is loading properly now.

[Kasami2k4]

Don't forget to scan your computer for viruses.

http://www.download.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10320142.html

=o

[stephysan]

that happen to me once.. idk i hit something and yeah :l
that can b possible too..

[Daphne]

Your site is loading fine for me right now..I hope you get all of this sorted out :(

[centerstage]

Contact Surpass!!!!!! If you haven't. Even though you have a backup, Surpass will look through your raw access logs and then get the ip of the hacker.

My site is on Surpass too and last week my hostee's site got hacked (but mine didn't get hack). Everything is ok now.

[Charlotte]

I was going to buy hosting with Surpass next month but like Tiffany said, there are a lot of sites hosted by them that are getting hacked. Do you think it is Surpass or just a coincidence?

[stevehoo]

Been there, done this. I'm pretty sure you caused this. You sent a delete command to perhaps a very large folder...

Quit and restart the FTP application to see what's happening and still there's files being deleted.

It takes quite a while to delete a very large folder and through FTP it looks like it does it folder by folder.

A hacker wouldn't delete files, they'll look for juicy things to steal or places to store nefarious files. And it probably won't happen the minute you're on the site too. Too much of a coincidence IMHO.

[centerstage]

I was going to buy hosting with Surpass next month but like Tiffany said, there are a lot of sites hosted by them that are getting hacked. Do you think it is Surpass or just a coincidence?

I've been using Surpass for 6 months now. I find that they are ok hosts, but I have had some downtimes but they offer a lot of bandwidth & space.

I'm not sure if it's just a coincidence though. :detective:

[.calidisaster]

Maybe it was :/ Who knows. I don't think i caused it...?!! But what could I poosible clicked that made the files being deleated. I'm still waiting for a response from surp**** JUST to make sure. I'm just glad I had files backed up on my computer.

[Kasami2k4]

How does stevehoo have 0 posts? >.>

Depends on the hacker. If it was someone with a personal vendetta against you, they'd totally do it.

[centerstage]

Any reply back from Surpass? Did you send a support ticket. I told one of the Surpass staff that my hostee's site and your site was hacked. She asked me this:

What kinds of applications are they using on their sites? Any situation will have a specific reason and are all unique to the type of website.

They refer to you. XD

[Kasami2k4]

Looks like her site is purely handcoded.