I am being hacked
Page 1 of 2 12 LastLast
Results 1 to 10 of 20

Thread: I am being hacked

  1. #1
    Junior Member
    Join Date
    Nov 2001
    Posts
    14

    I am being hacked

    I need some help because someone is logging into my site and deleting all my files.
    They are getting from FTP I believe and this is what I can get from my FTP session contol:
    proftpd: suzkaw nwusr-31395.dial-in.ttnet.net.tr: IDLE 18:52

    Also I have tried to change my password but it isn't working.

    Help me please.
    Thanks,
    Eric

  2. #2
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    you live in North Carolina, and your server is in turkey on a dial up connection? this does need some explaining cause i don't understand what your asking
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  3. #3
    Junior Member
    Join Date
    Nov 2001
    Posts
    14
    That is the person who is logging into my site. I am from NC and my host is too. I think that the person is logging in through FTP some how.
    Thanks,
    Eric

  4. #4
    Senior Member
    Join Date
    Apr 2002
    Posts
    317
    If they are loggin in to your site and deleting your stuff, report it to the site that hosts you. Give them full specs and complete information concerning you, your system, and the IP you are using to connect and update your site (You need to be able to demonstrate ownership of the files in question). Then provide them full information you have on the person believed to be doing you wrong. Once you have the greetings taken care of, offer them complete information on what you believe is happening, including the how, whens and whys.
    At this point, you may want to do some reasearch and see if they are patched. Perhaps recommending they get patched would be a good way to go.

    If this is your account, then talking to the hosting admins will be the only way to get it taken care of.

    Hope this helps.
    Regards.
    \"I believe that you can reach the point where there is no longer any difference between developing the habit of pretending to believe and developing the habit of believing.\"


  5. #5
    Junior Member
    Join Date
    Nov 2001
    Posts
    14
    Thanks for the tips I will do it right now.
    Thanks,
    Eric

  6. #6
    Banned
    Join Date
    Jun 2002
    Posts
    458
    OK, I'm gonna make a couple of suggestions here. First, are you running a firewall? If not, go to www.zonelabs.com and download the free version of Zone Alarm. Second, go to www.moosoft.com and download the trial version of 'The Cleaner' and use it to scan for trojans. Doing these two things could provide a quick solution. Good Luck!
    Um, the problem here is with his hosting company, not his PC. Could you explain what you mean? What do you mean logging in through ftp, are you running an ftp server? I don't fully understand.

    EDIT: Could you explain the following line in particular?
    They are getting from FTP I believe

  7. #7
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    you really arn't being very clear!
    it looks like you might have a web site that you maintain through ftp and someone guessed your password.
    If its being hosted by a reputable company your usually pretty safe but not always. The company i work for had a web site hosted by a 'reputable firm' and gave full access to anonymous users. nearly **** myself when i discovered that.

    odds are though your not using a good password scheme.
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  8. #8
    Old Fart
    Join Date
    Jun 2002
    Posts
    1,658

    Talking

    Guess I need to crank back the read speed and increase the comprehension level before I open my big keyboard. I was evidently bewildered on that one.
    Al
    It isn't paranoia when you KNOW they're out to get you...

  9. #9
    Banned
    Join Date
    Apr 2002
    Posts
    149
    unplug the cord from the wall

  10. #10
    Senior Member
    Join Date
    Apr 2002
    Posts
    712

    Re: I am being hacked

    Originally posted here by suzkaw
    I need some help because someone is logging into my site and deleting all my files.
    They are getting from FTP I believe and this is what I can get from my FTP session contol:
    proftpd: suzkaw nwusr-31395.dial-in.ttnet.net.tr: IDLE 18:52

    Also I have tried to change my password but it isn't working.

    Help me please.
    Well, you shouldn't have any "real" accounts in your FTP server, IMO. Both WU-FTPd and ProFTPd have means to use a password file separate from the real password file on the machine. Ideally, you should use a special password file with different usernames and passwords, then sandbox those users in to special directories (yes, I realize that you can still break out of a chroot'd environment).

    But, again, that doesn't solve this direct problem, but hopefully helps you prevent a similiar one in the future.

    Hopefully you have a good log on their activities... you can boot them and then report the activity to their service provider. Also, you should very carefully search the system for any additional things they might have left behind (with any luck, your logs might be able to help here), including things like a replaced or modified cshrc, login, profile or logout file.
    \"Windows has detected that a gnat has farted in the general vicinity. You must reboot for changes to take affect. Reboot now?\"

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •