Byron

This is what the Clam Scan returned: /home1/yashrs/public_html/tools.yash.tk/dns/1.php

You were suspended for having too many cron jobs. Your only allowed 2 cron runs per day. Ok I've unsuspended your account. Also make sure to login to your cpanel once a month or you'll get suspended for inactivity.

Done

I unsuspended your account. Just login and remove this file: /home/kymercer/public_html/ha.pl ftp login is the same as cpanel login. ftp.kymercer.heliohost.org

You were suspended for malware again. You never did remove the offending file: /home/kymercer/public_html/ha.pl: Trojan.IRCBot-1142 FOUND This was the same file I asked you to remove the last time: http://www.helionet.org/index/topic/20186-suspended-kymercer/

This support request is being escalated to our root admin.

Did you try deleting atmforex.gujarathairtransplant.com with the Advanced DNS Zone Editor?

Your account was suspended for the following reason: Malware found - 2 files: /home1/sayit/public_html/tp-images/file/20141031061340_php.jpg /home1/sayit/public_html/tp-images/file/image_php%00.jpg If you are you certain that it is a false-positive, we strongly encourage you to file a false positive form here: http://cgi.clamav.net/sendvirus.cgi Your account should be unsuspended now, but keep in mind that this is a temporary unsuspension. You have 24 hours starting at the time of this post to clean your account of any and all malicious files or your account will be resuspended.

I sent you a PM with the link to your backup.

I'm sorry but I can't. Your site just uses way too many resources. You had 3 chances to keep the load down and you didn't do anything about it. Would you like a backup of your site?

After reading what Krydos posted, I'm not willing to unsuspend your account. I will make a backup for you if you want.

I'll escalate this to Krydos and maybe he can tell you what programs or files are overloading the server and you can disable those. I'll unsuspend your account as long as Krydos doesn't object.

You were suspended for high server load for the 4th time. Usually 3 strikes in your out but you got another chance and it happened again. I'm sorry but I can't unsuspend your account again.

Your account was suspended for the following reason: Malware. 1 file(s). Php.Trojan.Spambot-2 FOUND That means that there are some malware files found on your account. For your safety and to protect your website from potential further corruption the account has been suspended. To find the infected files we recommend making a backup of your site, download the backup file to your computer, and scan the backup using a reputable virus and malware scanner. If you're having trouble locating the offending files please ask and we can provide more information. If you are you certain that it is a false-positive, we strongly encourage you to file a false positive form here: http://cgi.clamav.net/sendvirus.cgi Your account should be unsuspended now, but keep in mind that this is a temporary unsuspension. You have 24 hours starting at the time of this post to clean your account of any and all malicious files or your account will be resuspended. Edit: This is the offending file: /home/facditul/public_html/ofuscado.php

No, not without making your site active again and that would risk us being blacklisted all over again. I found these 2 links on the CBL site. Maybe they can help? https://threatpost.com/attackers-using-compromised-web-plug-ins-in-cryptophp-blackhat-seo-campaign/109505 http://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-inside-popular-content-management-systems/ Ok you should be able to login here: http://stevie.heliohost.org:2082/frontend/x3/index.phpcp and see the backup tar.gz file in the public_html folder ready for you to download. Let me know when your done.

How bout I make a backup of your site and then delete ALL files except the backup so you can download it. Once you've downloaded post back so I can delete the account. I think it'll be ok to create a new account but you can't upload any of the files from the backup. Agreed?

You were suspended for spamming.

Ok you've been unblocked.

Your ok now. There isn't too many processes running.

This should help you to understand why it's happening with a few suggestions on how to correct it: http://stackoverflow.com/questions/8028957/how-to-fix-headers-already-sent-error-in-php

You had too many php processes at once. Take care of whatever is causing all of these processes. At the time of this post, php is working on your site again. If you need me to kill the processes after you've corrected the problem, post back: 1931 arweth 15 0 238m 52m 9800 S 0.0 0.7 0:00.40 php 10136 arweth 15 0 238m 52m 9832 S 0.0 0.7 0:00.41 php 21670 arweth 15 0 238m 52m 9800 S 0.0 0.7 0:00.43 php 22088 arweth 15 0 238m 52m 9800 S 0.0 0.7 0:00.42 php 28835 arweth 15 0 238m 52m 9800 S 0.0 0.7 0:00.42 php

I have to kill the processes. You have to stop them from happening like wolstech said. I've killed these same processes on your account several times but they keep coming back. Let me know when you've correct the problem. 5376 pinkhtml 15 0 9036 1216 1008 S 0.0 0.0 0:00.03 gam_server 30039 pinkhtml 15 0 16864 1044 852 S 0.0 0.0 0:00.00 imapd 30040 pinkhtml 15 0 14776 932 772 S 0.0 0.0 0:00.00 imapd 30041 pinkhtml 15 0 16864 1040 852 S 0.0 0.0 0:00.00 imapd 30042 pinkhtml 16 0 14776 908 744 S 0.0 0.0 0:00.00 imapd 30043 pinkhtml 16 0 14776 908 744 S 0.0 0.0 0:00.00 imapd 30044 pinkhtml 15 0 14776 936 772 S 0.0 0.0 0:00.00 imapd

You've got too many php processes running at once. Kill the imapd: 27531 pinkhtml 15 0 16864 1000 824 S 0.0 0.0 0:00.00 imapd 27532 pinkhtml 15 0 16864 1032 852 S 0.0 0.0 0:00.00 imapd 27534 pinkhtml 15 0 16864 1004 824 S 0.0 0.0 0:00.00 imapd 27535 pinkhtml 15 0 16864 1040 852 S 0.0 0.0 0:00.00 imapd 27576 pinkhtml 15 0 9036 1148 1008 S 0.0 0.0 0:00.00 gam_server

Give your page a .php extension so it can parse the php.

Looks like your site is up now, Can you login to the cpanel from here? http://stevie.heliohost.org:2082/frontend/x3/index.phpcp