Krydos

Does it work now?

The database eb44345_QuizResults should now be visible to your root mysql account. You may need to delete, recreate, and reassign permissions to any database users that should have access to the affected database. Let us know if you're still having any issues accessing your data.

Please post the following information: Your cPanel username Your main domain The server that you are on

I changed the password on your account, logged in, and verified that the data is showing up in phpmyadmin. Your new password has been emailed to your contact email address. Let us know if you're having trouble logging in, or if you still can't figure out how to see the data in your database.

So, do you want me to delete that new database and restore your old data or are you sticking with the new database you created?

Did you create a new database with that same name eb44345_QuizResults?

Here is your load for the last week as a rank of users on your server. 1 means you were the highest load, so larger numbers mean less load and less chance of your account being suspended. Heliohost users can cause as much load as they want, but if the server's overall load gets too high and the performance of all of the accounts on that server start to degrade the system may be forced to suspend the highest load account to return to acceptable levels. Stevie is more sensitive to high load suspensions, which is part of the reason the uptime is better, and on Johnny users can cause a lot more load without being suspended. DATE CPU MEM ------------------- 2015-07-19 2 3 2015-07-20 1 2 2015-07-21 1 1 2015-07-22 1 1 2015-07-23 1 2 Suspended for ~4 hours. 2015-07-24 7 11 Suspended for ~10 hours. 2015-07-25 2 4 So, yes since your account was suspended for about half the day it definitely caused a lot less load for that day. Also note that on some of those days not only were you the highest load, but you were highest load by three or four times as much load as the second highest load account.

Here is the abuse report we received regarding your account: We have received a complaint about your account. Please investigate and fix within 24 hours. Hurricane Electric Abuse Department support@he.net From fblbounces@senderscore.net Mon Jul 20 06:42:32 2015 Return-Path: <fblbounces@senderscore.net> X-Original-To: report@abuse.he.net Delivered-To: report@abuse.he.net Received: from he.net (he.net [iPv6:2001:470:0:76::2]) by abuse.he.net (Postfix) with SMTP id EA54754036D for <report@abuse.he.net>; Mon, 20 Jul 2015 06:42:31 -0700 (PDT) Received: from mrb-fbl.returnpath.net ([66.45.29.179]) by he.net for <abuse@he.net>; Mon, 20 Jul 2015 06:43:42 -0700 Received: from poma01.lan.returnpath.net (poma01.lan.returnpath.net [10.2.0.106]) by mrb-fbl.returnpath.net (Postfix) with ESMTP id 0339062A02 for <abuse@he.net>; Mon, 20 Jul 2015 07:42:30 -0600 (MDT) Received: by poma01.lan.returnpath.net (Postfix, from userid 106706) id E300A606B3; Mon, 20 Jul 2015 07:42:29 -0600 (MDT) Content-Type: multipart/report; boundary="_----------=_14373997492588209414"; report-type="feedback-report" MIME-Version: 1.0 X-Mailer: MIME::Lite 3.029 (F2.84; T2.04; A2.12; B3.13; Q3.13) Date: Mon, 20 Jul 2015 07:42:29 -0600 Subject: Comcast Abuse Report To: abuse@he.net From: feedbackloop@comcastfbl.senderscore.net Message-Id: <20150720134229.E300A606B3@poma01.lan.returnpath.net> Content-Transfer-Encoding: 7bit This is a multi-part message in MIME format. ----------=_14373997492588209414 Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Type: text/plain This is a Comcast email abuse report for an email message received from IP 64.62.211.131 on Tue, 14 Jul 2015 21:59:52 +0000 ----------=_14373997492588209414 Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Type: message/feedback-report User-Agent: ReturnPathFBL/1.0 Abuse-Type: complaint Arrival-Date: Tue, 14 Jul 2015 21:59:52 +0000 Feedback-Type: abuse Version: 1 Source-IP: 64.62.211.131 Original-Rcpt-To: edc9076dd03a80a215dd864d4bb6bc51@comcast.net Original-Mail-From: webmaster@kkdjcomputersolutions.heliohost.org Reported-Domain: comcast.net ----------=_14373997492588209414 Content-Disposition: inline Content-Type: message/rfc822 Content-Transfer-Encoding: 7bit Path: waltersj@johnny.heliohost.org Received: from reszmta-po-02v.sys.comcast.net (LHLO reszmta-po-02v.sys.comcast.net) (96.114.154.194) by resmail-po-109v.sys.comcast.net with LMTP; Tue, 14 Jul 2015 22:00:02 +0000 (UTC) Received: from resimta-po-16v.sys.comcast.net ([96.114.154.144]) by reszmta-po-02v.sys.comcast.net with comcast id sN011q01o37BgFU01N02LB; Tue, 14 Jul 2015 22:00:02 +0000 Received: from johnny.heliohost.org ([64.62.211.131]) by resimta-po-16v.sys.comcast.net with comcast id sMzr1q00A2qf9oo01MzrJz; Tue, 14 Jul 2015 21:59:52 +0000 X-CAA-SPAM: 00000 X-Authority-Analysis: v=2.1 cv=OrGysHLt c=1 sm=1 tr=0 a=UGX5+mw3oW8i+imyuz22fA==:117 a=UGX5+mw3oW8i+imyuz22fA==:17 a=aNpNqCiWAAAA:8 a=C_IRinGWAAAA:8 a=GGcpBh7Jt_oA:10 a=wobHAGljAAAA:8 a=8nJEP1OIZ-IA:10 a=KT1TFeNMtz0A:10 a=zOBTXjUuO1YA:10 a=idUeeBFZ0deVN4vmTlgA:9 a=wPNLvfGTeEIA:10 a=wt3RFIUIoAYA:10 a=9cxlwZXvZSEA:10 Received: from waltersj by johnny.heliohost.org with local (Exim 4.82) (envelope-from <waltersj@johnny.heliohost.org>) id 1ZF8Ew-0004rV-8g for edc9076dd03a80a215dd864d4bb6bc51@comcast.net; Tue, 14 Jul 2015 14:59:50 -0700 From: KKDJ Computer Solutions Support Forum <webmaster@kkdjcomputersolutions.heliohost.org> X-Mailer: YaBB Sendmail Subject: Activation information for KKDJ Computer Solutions Support Forum Content-Type: text/plain; charset=ISO-8859-1 Message-Id: <E1ZF8Ew-0004rV-8g@johnny.heliohost.org> Date: Tue, 14 Jul 2015 14:59:50 -0700 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - johnny.heliohost.org X-AntiAbuse: Original Domain - comcast.net X-AntiAbuse: Originator/Caller UID/GID - [30802 32007] / [47 12] X-AntiAbuse: Sender Address Domain - johnny.heliohost.org X-Get-Message-Sender-Via: johnny.heliohost.org: authenticated_id: waltersj/from_h X-Source: /usr/local/bin/perl X-Source-Args: /usr/bin/perl -- YaBB.pl X-Source-Dir: kkdjcomputersolutions.heliohost.org:/public_html/cgi-bin/yabb2 To: edc9076dd03a80a215dd864d4bb6bc51@comcast.net Content-Transfer-Encoding: quoted-printable Welcome, MarilynTurnYO! Here is your account validation link. You have been successfully pre-registered at KKDJ Computer Solutions Supp= ort Forum. Please validate your account within 2 hours! Please click on the link below to activate your user account http://kkdjcomputersolutions.heliohost.org/cgi-bin/yabb2/YaBB.pl?action=3D= activate&username=3D173B28333623340E2F28345A0&activationkey=3DRk8n7Osyljz= f771KYyte If the link does not work (or if you use AOL or a browser-based Email pro= gram), copy the link and insert it in the address bar of your Web browse= r. Regards, The KKDJ Computer Solutions Support Forum team ----- ----------=_14373997492588209414-- My guess is that spam bots have discovered your yabb forum, and are creating accounts with random email addresses. One of those email addresses actually belong to someone and they flagged your email as spam since the bot tried to create the account not them. Let us know if you need more help with this. Your account has been unsuspended.

I see it using 38 MB.

Here's your top 3 for today: /home1/jeremy93/public_html/coc2u.cf/player.php /home1/jeremy93/public_html/coc2u.cf/clan.php /home1/jeremy93/public_html/coc2u.cf/s-results.php Yesterday it was: /home1/jeremy93/public_html/coc2u.cf/player-village.php /home1/jeremy93/public_html/coc2u.cf/s-results.php /home1/jeremy93/public_html/coc2u.cf/player.php The load is all coming from coc2u.cf

The database mrobo_titan-ras should now be visible to your root mysql account. You may need to delete, recreate, and reassign permissions to any database users that should have access to the affected database. Let us know if you're still having any issues accessing your data.

A link to your full site backup (including malware files) has been emailed to your hosting account contact email address. Your site files have been deleted. Your account, vav, has been unsuspended. Remember if you get a cryptophp infection again your account will be permanently suspended. Let us know if you need any further assistance.

Stevie has been experiencing pretty high load in general the last few days, and when the load gets this high the system is supposed to suspend some of the highest load accounts to help balance it back out, but I agree that a few of the suspensions have been excessive. I have made some changes to the automatic suspension system that should prevent this from happening again. Sorry for any inconvenience.

Dedicated IP granted.

The listed databases have been dropped.

Awesome! I got it. If anyone is curious I just started over completely from scratch. I went nuts and deleted everything I could find in the DNS system regarding heliohost.org and built the whole damn thing back up from nothing. There must have been some conflicting data or something before. I have no idea but it seems to work for me.

Yeah, I've restarted it like 50 times, and tried everything I can think of to clear the cache too. It just boggles my mind that both servers respond correctly when dig is used on the same server that named is running on, but not when queried remotely. I guess we just do the same thing we did years and years ago when I first discovered Heliohost as a user and something broke: Cross our fingers and hope Ashoat will come fix it for us. I do my best to keep Heliohost going, but this particular problem seems to be outside of my grasp. If anyone has any ideas of something to try, no matter how silly it may seem to you, I'm listening and willing to try it. Keep the suggestions coming.

Maybe someone on here can help us out. We've been waiting for Ashoat to fix the DNS for heliohost.org since he's the one who set it up originally, and he's the one who has fixed similar problems to this one in the past. However, this time he says he is too busy to help, and our main website has already been down a ridiculously long time so I'm desperate for any help getting this thing working again. I confess I'm very unfamiliar how he had this thing set up. Perhaps Piotr can be of assistance since his monitoring tool is familiar with how to responses are supposed to look? When I noticed that heliohost.org was down I realized that the zone file had gone missing from both ns1 and ns2. I rewrote /var/named/heliohost.org.db by hand ; Zone file for heliohost.org $TTL 14400 heliohost.org. 86400 IN SOA ns1.heliohost.org. ashoat.gmail.com. ( 2015071303 ;Serial Number 43200 ;refresh 7200 ;retry 1209600 ;expire 86400 ;minimum ) heliohost.org. 86400 IN NS ns1.heliohost.org. heliohost.org. 86400 IN NS ns2.heliohost.org. heliohost.org. 14400 IN A 64.62.211.132 localhost 14400 IN A 127.0.0.1 heliohost.org. 14400 IN MX 0 heliohost.org. www 14400 IN CNAME heliohost.org. ns2 14400 IN A 64.62.211.133 ns1 14400 IN A 65.19.143.3 and added zone "heliohost.org" { type master; file "/var/named/heliohost.org.db"; }; to /etc/named.conf. Is this data correct? ns2 responds # dig @ns2.heliohost.org heliohost.org ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19515 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;heliohost.org. IN A ;; ANSWER SECTION: heliohost.org. 14400 IN A 64.62.211.132 ;; AUTHORITY SECTION: heliohost.org. 86400 IN NS ns1.heliohost.org. heliohost.org. 86400 IN NS ns2.heliohost.org. ;; ADDITIONAL SECTION: ns1.heliohost.org. 14400 IN A 65.19.143.3 ns2.heliohost.org. 14400 IN A 64.62.211.133 ;; Query time: 122 msec ;; SERVER: 64.62.211.133#53(64.62.211.133) ;; WHEN: Wed Jul 15 07:51:55 2015 ;; MSG SIZE rcvd: 115 but your server monitor still shows ns2 as being broken. What response is your monitor expecting to see? Using the dig tool on google toolbox https://toolbox.googleapps.com/apps/dig/#A/heliohost.org@ns2.heliohost.org it shows ns2.heliohost.org responds with id 40180 opcode QUERY rcode REFUSED flags QR RD ;QUESTION heliohost.org. IN A ;ANSWER ;AUTHORITY ;ADDITIONAL but if I check another domain like krydos.heliohost.org https://toolbox.googleapps.com/apps/dig/#A/krydos.heliohost.org@ns2.heliohost.org it works id 28333 opcode QUERY rcode NOERROR flags QR AA RD ;QUESTION krydos.heliohost.org. IN A ;ANSWER krydos.heliohost.org. 14400 IN A 216.218.192.172 ;AUTHORITY krydos.heliohost.org. 86400 IN NS ns2.heliohost.org. krydos.heliohost.org. 86400 IN NS ns1.heliohost.org. ;ADDITIONAL

Cryptophp has been wreaking havoc on our servers and very negatively affecting thousands of users. I can't just unsuspend your account. What I can do is provide you with a full backup of your data, which will include the malware files, wipe your account clean, and unsuspend the mostly empty account. Your databases, mail accounts, domains, etc will all still exist, but your files will all be deleted to ensure the infection is gone. I suggest you read http://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-inside-popular-content-management-systems/ and other information about keeping your site malware free to arm yourself with the knowledge of how to prevent this from happening again. This will be your only chance, and if your site ends up getting suspended again for cryptophp it will be a permanent suspension with no chance of recovery. Would you like to proceed?

The account qahr has been unsuspended.

It looks like most of your load was coming from /usr/bin/php /home1/zrenethr/public_html/xmlrpc.php Since your site is wordpress, and there is a login link visible I wonder if bots have been creating thousands of accounts? Let us know if you need more help or ideas on how to reduce your load. The account zrenethr has been unsuspended.

You can't login to the email account scott@rockyglaciers.co.uk because that email address doesn't exist. To create an email account on your domain just go to http://stevie.heliohost.org:2082/frontend/x3/mail/pops.html and type the username, which is 'scott' in this case, and the password you would like to use. I went ahead and created that email address and tested it. I was able to log in just fine now that the email account is created. You can change the password of the email address on the same page I linked above. Let us know if you're still having any problems.

Glad everything is working for you again.

The databases you listed should now be visible to your root mysql account. You may need to delete, recreate, and reassign permissions to any database users that should have access to the affected database. Let us know if you're still having any issues accessing your data.

Ok, you're fine then. Is the port working for you?