I am being hacked

[suzkaw]

I need some help because someone is logging into my site and deleting all my files.
They are getting from FTP I believe and this is what I can get from my FTP session contol:
proftpd: suzkaw nwusr-31395.dial-in.ttnet.net.tr: IDLE 18:52

Also I have tried to change my password but it isn't working.

Help me please.

[Tedob1]

you live in North Carolina, and your server is in turkey on a dial up connection? this does need some explaining cause i don't understand what your asking

[suzkaw]

That is the person who is logging into my site. I am from NC and my host is too. I think that the person is logging in through FTP some how.

[chefer]

If they are loggin in to your site and deleting your stuff, report it to the site that hosts you. Give them full specs and complete information concerning you, your system, and the IP you are using to connect and update your site (You need to be able to demonstrate ownership of the files in question). Then provide them full information you have on the person believed to be doing you wrong. Once you have the greetings taken care of, offer them complete information on what you believe is happening, including the how, whens and whys.
At this point, you may want to do some reasearch and see if they are patched. Perhaps recommending they get patched would be a good way to go.

If this is your account, then talking to the hosting admins will be the only way to get it taken care of.

Hope this helps.
Regards.

[suzkaw]

Thanks for the tips I will do it right now.

[khakisrule]

OK, I'm gonna make a couple of suggestions here. First, are you running a firewall? If not, go to www.zonelabs.com and download the free version of Zone Alarm. Second, go to www.moosoft.com and download the trial version of 'The Cleaner' and use it to scan for trojans. Doing these two things could provide a quick solution. Good Luck!

Um, the problem here is with his hosting company, not his PC. Could you explain what you mean? What do you mean logging in through ftp, are you running an ftp server? I don't fully understand.

EDIT: Could you explain the following line in particular?

They are getting from FTP I believe

[Tedob1]

you really arn't being very clear!
it looks like you might have a web site that you maintain through ftp and someone guessed your password.
If its being hosted by a reputable company your usually pretty safe but not always. The company i work for had a web site hosted by a 'reputable firm' and gave full access to anonymous users. nearly **** myself when i discovered that.

odds are though your not using a good password scheme.

[allenb1963]

Guess I need to crank back the read speed and increase the comprehension level before I open my big keyboard. I was evidently bewildered on that one.

[AngryBob]

unplug the cord from the wall

[draziw]

Originally posted here by suzkaw
I need some help because someone is logging into my site and deleting all my files.
They are getting from FTP I believe and this is what I can get from my FTP session contol:
proftpd: suzkaw nwusr-31395.dial-in.ttnet.net.tr: IDLE 18:52

Also I have tried to change my password but it isn't working.

Help me please.

Well, you shouldn't have any "real" accounts in your FTP server, IMO. Both WU-FTPd and ProFTPd have means to use a password file separate from the real password file on the machine. Ideally, you should use a special password file with different usernames and passwords, then sandbox those users in to special directories (yes, I realize that you can still break out of a chroot'd environment).

But, again, that doesn't solve this direct problem, but hopefully helps you prevent a similiar one in the future.

Hopefully you have a good log on their activities... you can boot them and then report the activity to their service provider. Also, you should very carefully search the system for any additional things they might have left behind (with any luck, your logs might be able to help here), including things like a replaced or modified cshrc, login, profile or logout file.