Codezwiz >> Forums >> General PHP Nuke Help >> Some advice on a hosting issue

Hi - this is probably not the right forum board for this - but couldn't find an appropriate board - admins please feel free to move this post.

Basically a couple of days ago my VPS server got hit with a virus/hack - what this virus/hack did was to add malicious code in to all php and html files.

I wasn't the only one affected by this with my hosting company and lastest count for them was 380 clients affected. When this virus/hack was first detected, due to the nature of it the hosts couldn't help much as no host out there would be prepared to go through individual website files.

Anyway i was given the advice to go in to each file and remove this malicious code and hopefully that would sort out the problem - but 24 hours later when i was experiencing ftp issues when trying to overwrite the infected files with clean one i was getting transfer failed errors.

I again emailed the hosts and basically told them - that i cannot sort out this mess unless they had a look at the server because obviously any attempts at fixing it were being blocked.

To cut a long story short - my hosts looked further in to this issue - as i was not the only one emailing them - so they decided as the servers had been seriously compromized they had to bring in a security specialist to remove the SHS rootkit virus.

This sounded great as he was going to not only sort out each individual problem and occurance of this virus from website files, but he was also going to rid the server of any underlying virus and beef up the security.

However i was told that this would cost me, and everyone else that was hit - a total of $275 per domain - question is can they do this? I understand singular website security is not their call and is classed as custom work and incurrs a fee - but this virus was server related that altimately affected every website on the server - so why was i being charged to rid our site of this problem?

I was told that this particular hack/virus couldnt be removed by simple editing out some code from each file and that to completely remove it u must get to the root problem - which of course is the server - now because i'm on a managed VPS i do not have either the access or even the knowledge to get to the root problem - and surely i am not the one who should be looking after their server security?

End result was i didn't have that sort of money to immdeitely pay them - and also i didn't believe i should be charged for this mess - logging on to my webmil still proves this virus is still present - so what should i do?

Sorry about the long winded post - any advice is greatly apreciated

Sounds like a very unprofessional hosting company. Those costs should be paid by the hosting company. They may wish to raise the rates a dollar or two in hopes of getting back some of thier loss, but to put the whole loss on their clients is unheard of.

The file permissions problem can easily be fixed by your host by just giving back permissions to you for your files, depending on the server type chown should work just fine.

There are plenty of free software out there to check for rootkits and remove them. Sounds to me like your host doesn't know much about their servers.

380 Clients x $275.00 = $104,500.00

Don't they have backups? All good hosts store incremented backups so they can go back and restore if needed.

If I where in your shoes I would be looking for a new host!